orders controller and devise-able specs