Bug 26023: Properly secure the cashup and refund actions