Adding access control to /orders