User permissions not quite right after new site created

and after I fix it

the platform seems to be configured to be private by default?