Properly authorize order resources

Authorize on each element, can? doesn't work on collections