fleshing out the PUT and POST /api/orders/ backend