contributors being able to grant contributor to other users seems like a problem