Add system roles for default resource context. Enforce access controls
on default resource context. Add behave tests that prove enforcement
works. Add migration so that users don't lose the access they already
have.