payment: access rights limitation

Do not allow everybody to access account.transactions. Restrict by default to readonly and even restrict the access with a record rule.
Fixes #2424
This is totally unrelated to payment transactions, but as we are fixing security bugs...