Minimize the scope of runAsUser to support token passing

Need to defer the runAsUser until after files/jars have been fetched.

This is to support the HADOOP_TOKEN_FILE_LOCATION environment variable.
Bump Mesos to 0.16.0