Let customers pay their orders from the portal

Portal customers can pay an order: the Pay button uses POST, and the request no longer needs staff permissions.