Fix authorization on order#destroy