registered user management, and some kind of mass assignment protection at cart model level