Protect the @@myorders link in portlets.ShopAdmin portlet with the bda.plone.orders.ViewOwnOrders permission.