push cart creation logic back into model
assert staff can access all client routes