book: make cancels work correctly, and just off of orderid
me: handle ownership of orders to permission cancels and avoid self-match