[api] Allow users with read-only access to access /api/orders/:num
Return permissions for orders within the API results

This allows us to determine what information / buttons to display on the interface for an order
WIP: converting backbone code to Ember, porting over the views