call initgroups before becomming the user; patch from Fabio Cecchi