meta-app-framework: applaunchd: run under a separate user