Allow /_/contract routes to users with roles "partner", "head" or "supervisor"