More REST API tweaks

Two fixes:

* Fix a bug where default permissions weren't set when generating API keys for the first time
* Enforce a consistent response data type for the customers property of the orders endpoint