fix backend user access, fix payout cart account change

backend/controllers/KeyController.php

@@ -27,7 +27,19 @@ class KeyController extends Controller {
 										'post' 
 								] 
 						] 
-				] 
+				] ,
+				'access' => [
+						'class' => \yii\filters\AccessControl::className(),
+						'rules' => [
+								// allow authenticated users
+								[
+										'actions' => ['create','index','view','update'],
+										'allow' => true,
+										'roles' => ['admin','employee','reception'],
+								],
+								// everything else is denied
+						],
+				],
 		];
 	}