set default role and matching view mode in create controller actions
explicitly deny non admins/superusers the ability to change view mode
added validation on view mode permissions in the model