Add some commentary regarding an issue in `sudo' which affects `become';

I'm not fixing it yet because I don't think it's important.

Fixed the PATH lookup code to use the right binary name: `binary' rather
than `todo[0]'.  The two only differ when `style' is `l_login', in which
case `binary' has an initial `/' anyway, and the PATH lookup code is
never invoked.  The name is used in a buffer-overflow precheck, though,
and auditing is easier if the naming is consistent.