CUPS problem - managing jobs from LAN

[chipsafts]

I want to allow anyone on our LAN to resubmit a job , but not to do any other administration type tasks.
going to
http://ls.a.c:631/
works fine, though it allows users to go into admin.
getting to the jobs (http://ls.a.c:631/jobs/) also works.

but resubmitting the job
(http://ls.a.c:631/jobs/?op=restart-j...=/printers/TDL)
results in "client-error-forbidden"

here is the cupsd.conf file , with all comments removed.

ServerAdmin rootem@e.com
LogFilePerm 0600

MaxLogSize 2000000000

LogLevel info

PreserveJobFiles Yes
Printcap /etc/printcap

PrintcapFormat Solaris
User lp
Group sys

Timeout 175
<Location />
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
Allow From 192.168.1.15
</Location>


<Location /jobs>
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
Allow From 192.168.1.15
</Location>

<Location /admin>

AuthType Basic
AuthClass System
Order Deny,Allow
Allow From 192.168.1.*
Allow From 127.0.0.1
Allow From 192.168.1.15
</Location>

<Location /printers/test>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/DT128>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/5si>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/Tek>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/TDLR>
Order Deny,Allow
Deny From All
Allow From 192.168.1.15
Allow From 127.0.0.1
Allow From 192.168.1.*
AuthType None
</Location>
Browsing On
BrowseProtocols cups
BrowseOrder Deny,Allow
BrowseAddress 192.168.1.255
BrowseAllow from 192.168.1.0/255.255.255.0
BrowseAllow from 192.168.1.15
Listen *:631