orders create for non users

orders_controller_decorator.rb

Spree::Api::OrdersController.class_eval do
  # Remove the default authorize, we could move this functionality into
  # cancan later though...
  # authorize! :create, Order
  def create
    order_user = if @current_user_roles.include?('admin') && order_params[:user_id]
      Spree.user_class.find(order_params[:user_id])
    else
      current_api_user
    end

    # Wrapping the whopper in an if statement.
    # If we discover that this user already has an order,
    # hit them with an unauthorized...
    # OR we could just return that order?
    # Return false immediately if the user is an admin.
    if !current_api_user.admin? && Spree::Order.find_by(guest_token: cookies.signed[:guest_token])
      unauthorized
    else
      import_params = if @current_user_roles.include?("admin")
        params[:order].present? ? params[:order].permit! : {}
      else
        order_params
      end

      @order = Spree::Core::Importer::Order.import(order_user, import_params)
      render json: @order, status: 201, serializer: Spree::OrderSerializer
    end
  end
end