security: document no_new_privs