disable action buttons when order is paid and user is not an admin
fix filtering of unpaid orders; closes #4