Properly call Product#destroy. Fixes #3659
Allow for order_number param to match up order token with requested order

Fixes #4454