adds api for order_details, protected by basic auth

Do we care that the username/password will be getting checked in to git? We don't have a secrets file that's gitignored.