Try clarifying/unconfusing auth.inherit.CONTRIBUTE

maybe now general enough to apply to all cases