Add permission_required to orders index