refact and validate form, add permission, add statuses refund and refunded