only drop privs for TLS if still root