radclient doesn't support xlats, so we need to hack around any filter pairs marked as requiring expansion
Don't need to print the talloc message twice