Correct authorization for order tab

CanCan's can? doesn't work on collections, call it on each of the collections members.