added default role caps; improved user has cap filter