API endpoint: admin should be able to grant user access to a candidacy. Close #55