Secure order tracking

A reference alone is not enough; the private token is required too.