CUPS - how to allow anyone on LAN to resubmit a job

[stfaprc]

I want to allow anyone on our LAN to resubmit a job , but not to do any other administration type tasks.
going to

http://ls.a.c:631/

works fine, though it allows users to go into admin.
getting to the jobs (

http://ls.a.c:631/jobs/)

also works.

but resubmitting the job
(

http://ls.a.c:631/jobs/?op=restart-job&job_id=173&job_printer_uri=/printers/TDL)

results in "client-error-forbidden"

here is the cupsd.conf file , with all comments removed.

LogFilePerm 0600
MaxLogSize 2000000000

LogLevel info

PreserveJobFiles Yes
Printcap /etc/printcap

PrintcapFormat Solaris

User lp
Group sys

Timeout 175

<Location />
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>


<Location /jobs>
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>



<Location /admin>

AuthType Basic
AuthClass System
Order Deny,Allow
Deny From All
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>

<Location /printers/test>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/DT128>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/5si>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/Tek>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/TDL>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
Browsing On
BrowseProtocols cups
BrowseOrder Deny,Allow
BrowseAddress 192.168.1.255
BrowseAllow from 192.168.1.0/255.255.255.0
Listen *:631