fixed permissions for visit/view and removed back door

default users can add themselves to a visit

if default user is added to visit they have permission to add and
delete employees and activities from that visit