v3.0.2 Explicit PO access security

Even though PO is not visible on Dashboard but we also need to consider
that if the user has a PO url, he can access it explicitly. We've to
secure it for such use cases.