Finally sorted out the logic for adjusting privileges, I think.

This covers situations where a privilege already in the requested state is being re-requested, and also situations where the process doesn't have the requested privilege.

Also handle is now closed as required by the API.