Fix security issue when updating order by API.

Fixes #5711
Merge pull request #17 from gmacdougall/api-permissions-fix-2-3-dev

Fix issue when updating order by API.