More permissive handling of access to orders

To be more consistent with how access to products is handled in the
permission based dashboard, access to orders is now more permissive. As
long as one order line's partner has the current user in it's users,
access is granted.
Enable dashboard's IndexView for permission-based dashboard

The only change is that it checks for a 'index_nonstaff.html' template
first before using the standard index.html which displays potentially
sensitive store statistics.
Rename to is_user_a_partner_user

Naming things is hard, and @codeinthehole had a better suggestion.
Add docs for permission-based dashboard