added :order_status to attr_accessible to enable update by admin