authentication works for orders