allows only order owner to view an order