Allow applications to require a minimum key mask for authorization.

I think you missed the part below this... This is just to fix a bug where if we had a key with mask A trying to see if it had permissions for mask B, A & B always returns true if B > A even though A does not give permissions for B.