create default roles and their permissions, resolves #270

is there a more descriptive name than `CustomPermissions` that we can use? Are these specifically relevant to `XForm`s, maybe `XFormPermissions`?