Improve orders workflow so that enumeration is not possible, and so that the security code works as a password.