`ajax_tickets` force-deletes an arbitrary order via forgeable cart-cookie

A forgeable cart cookie lets an attacker force-delete any order through the open endpoint.

Checkout.php:362