[api] Require authorization to update an order through the API
Wrap permalink saving in a with_lock block to lock the table during updating

In addition, only select the permalink field from the table when querying all similarly-prefixed permalinks

This should prevent duplicate permalinks being generated by different processes hitting the database at the same time.

Fixes #2714