disable console in user builds

Also, run console as shell/log instead of root/root.

Change-Id: I6104f1edddfd5e11843ff41d7839d0c296e6a6f9

rootdir/init.rc

@@ -277,12 +277,18 @@ on boot
 
 ## Daemon processes to be run by init.
 ##
-service console /system/bin/sh
-    console
-
 service ueventd /sbin/ueventd
     critical
 
+service console /system/bin/sh
+    console
+    disabled
+    user shell
+    group log
+
+on property:ro.secure=0
+    start console
+
 # adbd is controlled by the persist.service.adb.enable system property
 service adbd /sbin/adbd
     disabled