OK ... I've fixed the minor problem with relational segment permissions and dotLRN works perfectly apparently.

And I've added an UPDATE statement to change context_ids which point explicitly to the security context root to the new value.

I am going to test here before committing, though - I should have this committed by this evening USA west coast time.