Missing authorization for payments?

I'm not sure if this is just a toy project, but there seem to be some issues regarding authorization. E.g.: I just used `http://127.0.0.1:8010/forms/payments/<id>/cancel/` without login.