Fix issue where the API allows orders to be cancelled when it shouldn't.

Gijs Hendriksen requested to merge fix/api-allows-cancel into master

There was a bug in the API where a user could cancel an order, even though it had been paid for or the event had ended.

Merge request reports