I did this originally on 2.5.2, should still be the same w/ 3.1.2, but let me verify.  I could also have some logic problems as I really didn't run this code a whole lot.

I see the problem now.  Security Binding Map is not created by default, so we'll need to create one first which appears to happen in UI when you switch from one or the other.  The default is effectively 'blank' and inherits the system defaults.

I'll look into this later, but feel free to share if you figure out a way.

Thanks so much for the help, I was really going down the wrong route before you directed me to the api method. I guess I need to start playing around with this and start getting use to it quickly seeing as we are migrating. Either-way I really appreciate the help and will definitely be keeping an eye on your blog.