fixes #62 - User can checkout when not allowed