Three timesheet rules that protect what you bill and pay