Fix order API: dereference req.params.order_id instead of req.params.id in mongo query