order controller fix: works w/ or w/o user