Address information is now only accessible through an order

This is because we need to first look up if the user has permission to view the order. If the user has the additional permission of being able to modify the order, then they should be able to modify the address too.

Fixes #3635