Enforce work order details permissions

Work Order details endpoint returned data without checking read permission and ignored the company argument. Now enforces both.