default permissions on modules; closes #24