routes should be POSTs for security.  Also put in a check to ensure that random people can't fulfill orders that may not ahve been paid for