Add order unit test, and close security hole