Bypass API permission check if administrator
Currently `403 Forbidden` is returned if the client lacks a required permission even if they are an administrator.

Administrator status should always trump permissions.
diff --git a/virtool/http/routes.py b/virtool/http/routes.py
index cff3dc208..657acd2b4 100644
--- a/virtool/http/routes.py
+++ b/virtool/http/routes.py
@@ -47,17 +47,18 @@ def protect(route_decorator, admin, permission, public, schema):
                     "message": "Requires authorization"
                 }, status=401)
 
-            if admin and not req["client"].administrator:
-                return json_response({
-                    "id": "not_permitted",
-                    "message": "Requires administrative privilege"
-                }, status=403)
-
-            if permission and not req["client"].permissions[permission]:
-                return json_response({
-                    "id": "not_permitted",
-                    "message": "Not permitted"
-                }, status=403)
+            if not req["client"].administrator:
+                if admin:
+                    return json_response({
+                        "id": "not_permitted",
+                        "message": "Requires administrative privilege"
+                    }, status=403)
+
+                if permission and not req["client"].permissions[permission]:
+                    return json_response({
+                        "id": "not_permitted",
+                        "message": "Not permitted"
+                    }, status=403)
 
             content_type = req.headers.get("Content-type", "")
 
['virtool/http/routes.py']