Bump app-validator

+ Add `contacts` permission