Fix issue where the API allows orders to be cancelled when it shouldn't.

There was a bug in the API where a user could cancel an order, even though it had been paid for or the event had ended.