changed customer => order for readability (c is configuration, o is order)
added context-based authorization