Only accept orders that are marked completed

Fixes an exploit abused by
http://steamcommunity.com/profiles/76561198075828158 to steal 13 keys.
Ouch!