renumbered states
fixed state numbering
not finding customer in session now leads to FORBIDDEN instead of BAD REQUEST to ease debugging