https://fedorahosted.org/freeipa/ticket/1259 Python code will see nsaccountlock as bool. JavaScript code will also see it as bool. This allows native boolean operations with the lock field. Passes both CLI and WebUI tests.
ticket https://fedorahosted.org/freeipa/ticket/1265
ticket 1146
Jakub did the initial diagnosis of this, I added a fix for removing the last entry when removing members and a test case. ticket 1000