applied authorize to user and order controller test