Why does rc.subr try to change privileges to *_user during stop?

My immediate reaction is that when shutdown is invoked by
user-in-group-operator the rc.d processing must run as root; they have
to in order to do most things.  So perhaps su is getting confused
between USER vs uid, or the framework isn't doing this quite right.

-- 
        Greg Troxel <gdt@ir.bbn.com>