mod_roster configuration

Hello.

I can not properly configure ejabberd. I do not want to give the possibility to add/remove roster to any user except admin. I found https://docs.ejabberd.im/admin/guide/configuration/#modroster but it does not work for me.
I have external auth script, which is very similar to https://www.ejabberd.im/node/4000.
I am using ejabberd 2.1.11.

My config:
%% Admin user
{acl, admin, {user, "admin", "localhost"}}.
...
{access, roster, [{allow, admin}]}.
...
{mod_roster, [{access, roster}]},

Using Pidgin I can log in using my Django user login and password, but I can also send subscription requests, accept them and remove rosters, but I should not be possible.