New content types (and other dynamic) permissions are not auto-selected for admin role—always give it all perms