added validations and errors with cancan to prevent unapproved users from creating orders or transactions