Add permissions to contact API routes