User allowed attr only in orders controller [api]