Fill the CC list.
Permission on the update view.
Global permissions management.
Restrict the invoice views to logged in users.
Added a test on invoice's update.