payment controller (not finish)