Use separate sync user

This allows us to protect cached credentials from Apache