add vieworder permission to protect @@showorder
re-change to Authenticated and document the use case, why authenticated is used as role for these permissions.
rename perm `View Order` to `View Order Directly`