Donation api permission fix

Allow updating the donation when the current user is authenticated and the order is referenced in the session CLUB-971