Fix API keys permissions bug

When API keys were generated for the first time, the permissions
weren’t set, which required an additional save before they were set.
This commit fixes this to set `read` permissions by default when
initially generating API keys.

Part of #4055
Make customer data for orders endpoint consistent for guest orders

Simply returning ‘guest’ for the customer property changes the data
type of the response from a dictionary to string which is bad for
clients that should be able to always expect a dictionary. This commit
fixes that by using the same dictionary structure as registered
customer orders, but excluding fields which aren’t applicable. Clients
can determine guest vs. registered customer orders by inspecting the
value of customer ID, which is 0 for guest orders.
Merge pull request #4568 from maxrice/rest-api-fixes

More REST API tweaks