one reference itself and another is added by sudo_getgr{gid,nam}
and sudo_getpw{uid,nam}. The final ref on the runas and user passwd
and group structs are persistent for now.
not TLS_CACERTFILE in its ldap.conf. Other LDAP client code, such as
nss_ldap, uses TLS_CACERTFILE. Also document why you should avoid
disabling TLS_CHECKPEER is possible.
Set adminstrative domain for the process when looking up user's
password or group info and when preparing for execve().
Include strings.h even if string.h exists since they may define
different things. Fixes warnings on AIX and others.
