Bug 1050628: flag state API doesn't honour bug or attachment security