Small POS code refactor.

This commit moves most of the crappy logic that was in the view
out to the controller where it actually belongs. It quite
possibly also fixes #272.
Merge remote-tracking branch 'upstream/dev' into security