fix bug: 'order for not autorize user'