diff --git a/make_post_sell/views/cart.py b/make_post_sell/views/cart.py
index b2352bb..921ee38 100644
--- a/make_post_sell/views/cart.py
+++ b/make_post_sell/views/cart.py
@@ -172,8 +172,12 @@ def cart_by_id(request):
     if cart is None:
         msg = ("That cart_id does not exist.", "error")
 
-    elif cart.public or (
-        request.user and request.user.authenticated and request.user.owns_cart(cart)
+    elif (
+        cart.user is None
+        or cart.public
+        or (
+            request.user and request.user.authenticated and request.user.owns_cart(cart)
+        )
     ):
         # remove invalid coupons from cart, if any.
         for coupon in cart.coupons:
@@ -217,27 +221,28 @@ def cart_add_product(request):
 
     product = get_product_by_id(request.dbsession, product_id)
 
-    if product is None:
+    if request.user and request.user.does_not_own_cart(request.active_cart):
+        msg = ("You do not own this cart.", "error")
+
+    elif product is None:
         msg = ("invalid product_id.", "error")
-        request.session.flash(msg)
-        return HTTPFound(get_referer_or_home(request))
 
     elif product.is_not_ready:
         msg = ("that product is not ready for purchase.", "error")
-        request.session.flash(msg)
-        return HTTPFound(get_referer_or_home(request))
 
     elif product.is_not_sellable:
         msg = ("that content is not for sale or purchase.", "error")
-        request.session.flash(msg)
-        return HTTPFound(get_referer_or_home(request))
 
-    msg = ('You added "{}" to your cart.'.format(product.title), "success")
-    request.active_cart.add_product(product)
-    request.dbsession.add(request.active_cart)
-    request.dbsession.flush()
+    else:
+        msg = ('You added "{}" to your cart.'.format(product.title), "success")
+        request.active_cart.add_product(product)
+        request.dbsession.add(request.active_cart)
+        request.dbsession.flush()
+        request.session.flash(msg)
+        return HTTPFound("/cart")
+
     request.session.flash(msg)
-    return HTTPFound("/cart")
+    return HTTPFound(get_referer_or_home(request))
 
 
 @view_config(route_name="cart_remove_product")
@@ -255,21 +260,25 @@ def cart_remove_product(request):
     if cart is None:
         msg = ("That cart_id does not exist.", "error")
 
+    elif request.user and request.user.does_not_own_cart(cart):
+        msg = ("You do not own this cart.", "error")
+
+    elif request.user is None and cart.user is not None:
+        msg = ("You do not own this cart.", "error")
+
+    elif request.user is None and cart.user is not None:
+        msg = ("You do not own this cart.", "error")
+
     elif product is None:
         msg = ("That product_id does not exist.", "error")
 
-    elif cart.active or (
-        request.user and request.user.authenticated and request.user.owns_cart(cart)
-    ):
+    else:
         msg = ('You removed "{}" from the cart.'.format(product.title), "success")
         cart.remove_product(product)
         cart.remove_handling_if_no_physical_products()
         request.dbsession.add(cart)
         request.dbsession.flush()
 
-    else:
-        msg = ("You do not own that cart.", "error")
-
     request.session.flash(msg)
     return HTTPFound(get_referer_or_home(request))
 
@@ -302,6 +311,16 @@ def cart_quantity_product(request):
     if cart is None:
         msg = ("That cart_id does not exist.", "error")
 
+    elif request.user and request.user.does_not_own_cart(cart):
+        msg = ("You do not own this cart.", "error")
+        request.session.flash(msg)
+        return HTTPFound(get_referer_or_home(request))
+
+    elif request.user is None and cart.user is not None:
+        msg = ("You do not own this cart.", "error")
+        request.session.flash(msg)
+        return HTTPFound(get_referer_or_home(request))
+
     elif product is None:
         msg = ("That product_id does not exist.", "error")
         request.session.flash(msg)
@@ -314,10 +333,7 @@ def cart_quantity_product(request):
             ("Refusing to add a product from another shop to cart.", "error")
         )
         return HTTPFound("/cart")
-
-    elif cart.active or (
-        request.user and request.user.authenticated and request.user.owns_cart(cart)
-    ):
+    else:
         msg = (
             'You updated the quantity of "{}" in the cart.'.format(product.title),
             "success",
@@ -326,9 +342,6 @@ def cart_quantity_product(request):
         request.dbsession.add(cart)
         request.dbsession.flush()
 
-    else:
-        msg = ("You do not own that cart.", "error")
-
     request.session.flash(msg)
     return HTTPFound(get_referer_or_home(request))
 
@@ -338,6 +351,14 @@ def cart_handling_option(request):
     cart = get_cart_from_matchdict(request)
     handling_option = request.params.get("handling_option")
 
+    if request.user and request.user.does_not_own_cart(cart):
+        request.session.flash(("You do not own this cart.", "error"))
+        return HTTPFound(get_referer_or_home(request))
+
+    if request.user is None and cart.user is not None:
+        request.session.flash(("You do not own this cart.", "error"))
+        return HTTPFound(get_referer_or_home(request))
+
     if handling_option not in [
         "local_pickup",
         "local_delivery",