fix update permissions on orders

correct update permissions for updating, validating, canceling and
closing orders.
Do not log Authentication SQL statemets