Protect method "all". All purchases can see only the user with the role of "administrator"