[SECURITY] ~fix access to pos.make.payment