rewrite cart creation and merge (make work as discussed), fix issues with autorunning too much, remove observe/sync which caused infinite loop, fix cart allow/deny security