Allow customer created return authorizations through the API

The creation of return authorizations through the API was currently only available to admins. This change allows the customer to create return authorizations for orders they are associated with.