fix order_holds permission