now that we use ih.key earlier, we need to do all its setup early enough
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>