[th/csd-wrapper-fixes] fix leak and avoid calling csd-wrapper as root

Follow up to !2

• fixes leak discussed at !2 (comment 348016)

• only use csd-wrapper script, if we know we are going to actually drop privs.