Restricted settings are built with --ll-exception

So that we at least have some more info when that goes wrong (like it does
right now on Jarvis).  Unfortunately, I couldn't find the place in the JVM
build process to tweak.  Patches welcome!