Avoid binding cart to checkout object

We don't want to tempt users to access it directly and shoot themselves
in the foot.