Restrict contributions endpoint to only admins