Orders are fetched from `/api/orders` (requires a token).