Add endpoint to retrieve a current user's orders in the API.

Returns 401 if the user is anonymous.

Fixes #4022
foo