It occurred to me that the tacacs user is set only at build time. So, if someone assigned a different uid to their runtime tacacs user, the daemon would, by default, run under uid 559. So, add a default "-U tacacs" to the flags. While here, fix a typo in the man page.