restrict user permissions, fix report header
remove autocomplete on invoice