restrict invoice documents to admin view