Prevent access to other users' order when logged in (#126)