user can only view own orders, closes issue #102