Fix default user permissions / view mode dropdown

[orenyk]

Discovered through my Heroku instance (#275), all new users on master are created as admins. We need to make sure this defaults to patron.

---

• set missing role to normal in controller create methods (create and quick_create)
• ensure that the view_mode is set to the role
• ensure that users with roles other than admin and superuser cannot change the view mode
• add migration to change default view_mode in schema.rb

[orenyk]

Looking at the list of users, everyone but me has the normal role, so I'm trying to figure out what the actual bug was.

[mnquintana]

Per our (super long) convo in Slack, we at the very least have confirmed this bug and have some steps for resolution:

1. create a migration to change the default value for view_mode to be normal
2. add this to user#create for a double measure of security (I don't think we should rely exclusively on db defaults personally, as they may be handled differently by different dbs):

@user.role = 'normal' if params[:role].blank?
@user.view_mode = @user.role

1. Explicitly add that normal users cannot change views w/ cancan

We're also giving view_mode powers it shouldn't have (ie. role should really be granting access, not so much view_mode) - @orenyk @dgoerger and I are investigating now.