actually fixed privilege dropping