Make sure to downgrade to app permissions when invoking callbacks

The [private] binder interface is called from the system process, so make sure
we downgrade to the app's proper identity & permissions before allowing
execution to continue into app code.