Merge "Set groups before dropping privileges." into nyc-dev