change the nav of the user/orders page and add access control