fixes #4641 - Ensure default role only after save/update. Change default role permissions