Missing authorization for payments? #4

I'm not sure if this is just a toy project, but there seem to be some issues regarding authorization. E.g.: I just used http://127.0.0.1:8010/forms/payments/<id>/cancel/ without login.