I see the problem now.  Security Binding Map is not created by default, so we'll need to create one first which appears to happen in UI when you switch from one or the other.  The default is effectively 'blank' and inherits the system defaults.

I'll look into this later, but feel free to share if you figure out a way.