Permissions not respected for configuration settings

[briddle]

The configuration settings in:

• Pay > Invoice template and...
• Pay > Payment settings

show up in the settings menu even if the active backend user does not have permission to see them.

[briddle]

I also noticed that the Invoices controller does not check pay.access_invoices permission so any backend user can request backend/responsiv/pay/invoices and see/create/edit invoices.

The same is true for the other controllers, including those that store API-credentials (e.g. Stripe).

This is a rather serious potential breach of customer data for websites that utilise multiple backend users with different permissions.