Restrict access to admin for #11
List all orders [closes #8]