It looks like there is a bit that says whether or not a user has an access mask that also needs to be set. If you look in admincp/user.php at the section that starts:
HTML Code:
// ###################### Start Update Access #######################
if ($_POST['do'] == 'updateaccess')
{
(around line 1166) you can see how the access mask is changed when you do it via the admincp.