OK ... I've fixed the minor problem with relational segment permissions and dotLRN works perfectly apparently.
And I've added an UPDATE statement to change context_ids which point explicitly to the security context root to the new value.
I am going to test here before committing, though - I should have this committed by this evening USA west coast time.
