added user_id as attr_accessible for orders