Add permission checks on get_invoices

POS invoice endpoint was accessible without permission checks.