latest changes

* fixes picture.php?id= security issue
* updates to billing system
* fixes Event screen permission login