introduce uuid for order, make sure order only be viewed by one user