fix: default_access() prevents some users from creating group widgets

fixes #25