fix routes permissions and contributors permissions on the ui