Default permissions only allow 'administrator' to add media

In one of the media upgrades the 'access media browser' permission was added, but we never setup any default permissions. So, this means that anyone except for those with the 'administrator' can upload media. If you click the 'Add media' button in the WYSIWYG, for example, the dialog will appear and say "You are not authorized to access this page."

I'll upload a patch in a moment that uses defaultconfig to set this permission to allow all authenticated users, and a hook_update_N() function to add it on existing sites.