Once you have created an order you can use the guest token to modify it before a user is created. But what token do we use for creating the order in the first place? It seems a simple request against OrdersController#create requires an API token. Seems to be a chicken / egg situation. What am I missing?