Fixes for donation api permissions

- only allow order/donation creation if the order belongs to current user or their is no user defined (anonymous)