1. Restrict usernames to lower case
2. After setting up security and before the server restart, save the 'configure system' page even if no changes have been made - not sure if this is required (I was following a suggestion by someone more in the know than I), but it won't hurt.
User permissions now persist after restart on my instance.
I have updated the JIRA ticket I created.
Regards
Chris