api: wrong implementation of POST /orders handler, need validation as soon as possibile :-)