allow guests to use the payments api for their orders

Working on a ember checkout app and found that guest users can't access the payments api because it doesn't check use order_token to authorize against orders.  Test and fix included.