[api] Attempt authorization for an order if an order token is passed

This stops the 'You must specify an API key' error message from (incorrectly) appearing. That message is now supressed if an order token is passed in.

When an order token is passed, the authorize_for_order filter is called, which attempts to find an order and then compares the order's token with the order token from params/headers