How can I run a webserver on boot without root rights (as another user)? I could just add it in rc.local, but it's run under root user.
Why? What are you trying to achieve?
The first thing Apache does after becoming a daemon and listeing on a port is to setuid to the user defined in the config files - i.e. it does not run with root rights.
It's impossible to start a daemon listening on a port below 1024 unless you are root - but its perfectly possible to start it listening on, say port 8000, and also quite possible to set up iptables to proxy port 80 requests to port 8000 - but only root processes can setuid to a different uid - so you'll need to change your Apache config so that either it doesn't call setuid, or it only calls setuid to the current uid.
If you are concerned about security then there are lots of other things you should consider doing before you try to repair a security hole which is effectively non-existant.
Search for the following section in the httpd config file:
and change the 'daemon' user and group to the required user name.