fixed test and controller so they don't allow invalid carts in the url