create default roles and their permissions, resolves #270

should we have a test for `put` requests as well?