the pre-receive wrapper needs to be suid after all