Bug fix: unauthenticated users could still click qty label