Update scenarios

- Every user can create/view payment without login
- Admin had the right to fire/recruit a user