create default roles and their permissions, resolves #270

if there are tests for this elsewhere, that's fine.