add default roles for membership rather than set roles_mask directly in before_create callback. related to gh-256