User must not see invoices if no rights