restrict paths and HTTP methods for contacts resource