CUPS - how to allow a LAN user to resubmit a job

I want to allow anyone on our LAN to resubmit a job , but not to do
any other administration type tasks.
going to
http://ls.a.c:631/
works fine, though it allows users to go into admin.
getting to the jobs (http://ls.a.c:631/jobs/) also works.

but resubmitting the job
(http://ls.a.c:631/jobs/?op=restart-j..._printer_uri=/
printers/TDL)
results in "client-error-forbidden"

If I try on the server, using localhost, then it works fine.

here is the cupsd.conf file , with all comments removed.
CODE
LogFilePerm 0600
MaxLogSize 2000000000

LogLevel info

PreserveJobFiles Yes
Printcap /etc/printcap

PrintcapFormat Solaris

User lp
Group sys

Timeout 175

<Location />
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>


<Location /jobs>
Order Allow,Deny
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>



<Location /admin>

AuthType Basic
AuthClass System
Order Deny,Allow
Deny From All
Allow From 192.168.1.*
Allow From 127.0.0.1
</Location>

<Location /printers/test>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/DT128>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/5si>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
<Location /printers/Tek>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
<Location /printers/TDL>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
Allow from All
</Location>
Browsing On
BrowseProtocols cups
BrowseOrder Deny,Allow
BrowseAddress 192.168.1.255
BrowseAllow from 192.168.1.0/255.255.255.0
Listen *:631