fixed shopping cart. user must see only his cart. Sanitized against cart url manipulation ;)