fix #349, restrict get /contacts* route