added access control for refund
moved isRefunable() from RefundManager to RefundControler class