restricted access to orders and renamed routes for orders