adds api for order_details, protected by basic auth

Would this be worth pulling some of this into the individual model's `to_json` method. Or something like a `UserJsonRenderer`. That would allow you to use the same thing for the owner and ordered_for rendering.