Drop privileges if ran as root, using user and group conf settings
Serve static files directly using the app
Do not serve publicly anything related to the app
Store zip files from the location where nginx would look for them
Set up default template path in start() instead of dangling statement
Do not use 2SV by default
Create zipball directory and the unprivileged user for running the app