Access Control logic fixed

No need to set the permission for parent URL.
Enable the parent URL by detecting if it has child URL.
Timesheet update