User user from order instead of logged in user

This is long overdue, we should be pulling as much data as possible
from the order directly to ensure no funny business.