Fix security issue when updating order by API.

Fixes #5711

Conflicts:
	api/app/controllers/spree/api/base_controller.rb