Systemd controller does not work in user space with Delegate=yes services

According to the documentation for Systemd units, `User=` units should be able to control subhierarchies under its own control group path as long as they are `Delegate=`. I have been unable to get this functionality to work with this package.

Consider the following unit `mattdaemon.service` (remember to substitute `$USER` with a regular non-root user):

```
[Unit]
Description=User space delegate test

[Service]
Type=simple
Delegate=yes
User=$USER
ExecStart=/path/to/binary/failor
```

Assume `/path/to/binary` contains a binary built with `go build` from the following source code:

```
package main

import (
"log"
"os"

"github.com/containerd/cgroups"
specs "github.com/opencontainers/runtime-spec/specs-go"
)

func main() {
// load the cgroup for "this" process -- since we assume we run in a Delegate=yes user unit,
// we can only control subhierarchies beneath this control group
unitGroup, err := cgroups.Load(cgroups.Systemd, cgroups.PidPath(os.Getpid()))
if err != nil {
log.Panicln("Load:", err)
}

// create a subgroup based on cgroup.Cgroups interface
control, err := unitGroup.New("subway", &specs.LinuxResources{})
if err != nil {
// Interactive authentication required
log.Panicln("New:", err)
}
/* if this were a unit test, we would continue by creating a process and adding it to our sub group */
log.Println("Success!") // Only gets printed if Unit is run by root
_ = control // rest of code stubbed
}
```

Reproduce the bug by starting the unit:

```
$ sudo systemctl daemon-reload
$ sudo systemctl start mattdaemon.service
$ journalctl -xafe --unit=mattdaemon.service
```

*Journal Output*
```
Nov 03 11:58:55 devthrostur01 failor[23042]: 2017/11/03 11:58:55 New: Interactive authentication required.
Nov 03 11:58:55 devthrostur01 systemd[1]: mattdaemon.service: main process exited, code=exited, status=2/INVALIDARGUMENT
...
```

We can enable the functionality by removing the `User=` line from the systemd unit, but this should not be necessary as per the docs (`man 5 systemd.resource-control`) since we have enabled `Delegate=yes`.