make sure ajax save (on dashboard and when editing access lists) sanitizes plugin options. note: this also updates approved user roles.