Setting user.security.flags[1-4], exemptions, or restrictions to a string value
would result in unexpected modified values:

1. The exiting flags were all based on the current value of flags1 (copy/paste
    error it appears)
2. The set/removed/added flags were all "off-by-one" because str_to_bits()
    treats 'A' as bit-1, not bit-0.

emailval.js is now using this feature and PSI-Jack reported the "interesting"
behavior. :-)