Cart security for #739

Make sure we don't return any cart to the user unless it's in a STATE_CART

Fixes #739