Hello Bounty,
I found this bug in 3.2 and also in 3.3 seeing your code :
if a user have no flag (whatever the reason is) he can logon when site is closed or disabled.
In fact ocscript crashes with 'can't read "flagline": no such variable'..
Yes user without any flag have no 'flags' tag in their user file.
Anyway good job