Added access control test for payment controller
Fixed PaymentController using wrong exception