Add permission_required to views in orders