I just had an issue with my plugin WP Access Areas (see aside*), where all capabilities added to a user get lost, after assigning a role through URE: https://github.com/mcguffin/wp-access-areas/issues/14
I sneaked a little bit in your code and I noticed that the plugin does not keep what it finds in the users capabilites array, but deletes everything and reassigns what it finds in $_POST.
I don't know if you plan to change this behavior in a future release, but it would make me very glad (and maybe some users as well), when both plugins could be talked into cooperating with each other.
Please let me know, what you think.
(*Aside: WP Access Areas defines custom-named capabilities, assigns them to posts and users (via
$user->add_cap()) and determines mainly through
current_user_can() if someone is permitted to view, edit or comment a post.)