Pizza orders reachable for people not in the organising member group

One-sentence description

Pizza orders reachable for people not in the organising member group

Current behaviour / Reproducing the bug

1. Make a pizza event and add some orders
2. Your user should not be a superuser
3. Try to mark the orders as paid in the frontend
4. Clicking doesn't do anything

Expected behaviour

1. Make a pizza event and add some orders
2. Your user should not be a superuser
3. Try to mark the orders as paid in the frontend
4. The orders page is permission denied