Clean up rights logic

Main addition is to raise error if default_rights= is called with an
unrecognized value.

Also trimmed trailing whitespace.