chanserv/access: enforce restrictflags checking correctly (closes #159)