Add permissions to current order api.

@gannetson I just need a sanity check on this. Thanks! Ben