Remove json_authenticity check from Admin::UsersController

This is not necessary any more because the index action no longer serves JSON
[api] Allow users with read-only access to access /api/orders/:num
Return permissions for orders within the API results

This allows us to determine what information / buttons to display on the interface for an order
Remove unusued customer route
Make a request to /api/users/:id, rather than /api/users
fetch instead of refreshing an order (same same)
Ensure generate_admin_api_key is called
Restrict information shown on line items + addresses page based on permissions
Show special instructions on delivery page
Correct formatting of inventory states in shipment manifest
Use 'read' permission in BarAbility

This seems to make my new OrdersController API test happy, and it's getting late in the day so I am too lazy to investigate why this is necessary, soooo
WIP: Implementing specs for new order interface