fix: user can access all admin routes when adding him as contributor

Edited by Yassine Doghri