authentication in create_order