make sure a user cannot see other users order