Nice smooth workflow, payment works.  hooray. refund and other adminy stuff now have permissions.

next up is email and specs