create default roles and their permissions, resolves #270

this and the above could be one giant `if`, or you could make the `if` condition a separate function, i.e. `if _has_xform_permission(xform, request_user)`, or you could intermediate assign `user = xform.user` after the first if to simplify the calls