Amending access control for /order