[api] Move authorize! call for OrdersController#update to AFTER @order is defined