Field-level authorization

Checking a user's rights on a single field, not a whole operation. `Order.email` calls `requireStaff` so emails don't leak wherever an order appears.