use session when checking permissions
allow user to access orders
add accounts page; update client session code