adds api for order_details, protected by basic auth

nucore uses the odd settings.local.yml convention; I could see setting it to nil rather than empty string for the purpose of preventing access by default