add process to get permissions right for migrations

roc edited User+*type+*accountable, which shouldn't have been possible given that initial permissions has this line:

:star=> {:edit=>:admin, :delete=>:admin},

But i'm guessing we only consult that code when we're generating initial content for new sites, right? And not when we're migrating?