routes/orders.js: use merchant instead of merchant_id.