Filter user & role caps to grant `view_stream` cap based on allowed
roles