add default roles for membership rather than set roles_mask directly in before_create callback. related to gh-256
Merge remote-tracking branch 'upstream/master'