verify if a user can fire a following event on order or not

Fixes #3818
Reload rules select2 box after picking a PromotionRule

So that the chosen rule no longer is displayed on the select2 box, users
can associate each rule only once with the promotion

Fixes #3572
Fixes #3816
Don't convert list of stock items to an array if all we need to do is sum

Conflicts:
	core/app/models/spree/stock/quantifier.rb
Must set calculable before saving new calculator in MigrateOldShippingCalculators migration, otherwise MySQL screams
Use Spree.url() to add tokens to API calls to stock_locations

On 2.0, stock_locations AJAX class are getting a 401 on http://localhost:3000/admin/stock_transfers/new since securing the stock locations API end points.

Fixes #3828
Correct set completed_at in cancelling_and_resuming spec
Set stock_item count_on_hand and use that in variant#in_stock? test
Remove ControllerHelpers::SSL `force_ssl_redirect`

Turns out that Rails 4 introduced a `force_ssl_redirect` as well and
so that method got overriden from within spree core. The spree
implementation however expected the only param passed to be a string or
something that we could assign :host and on Rails ForceSSL a hash is
given instead so this statement would be true

    redirect_options.merge!(:host => host) if host

and users would get the error described in https://github.com/spree/spree/issues/3283

Here's the current Rails ForceSSL implementation https://github.com/rails/rails/blob/v4.0.0/actionpack/lib/action_controller/metal/force_ssl.rb#L66
and in 3.2.14 https://github.com/rails/rails/blob/v3.2.14/actionpack/lib/action_controller/metal/force_ssl.rb

Removing the `force_ssl_redirect` from spree core seems to fix the issue
as that method was just a copy of the old implementation of Rails
`force_ssl` which is already called from spree SSL module

Remove spec setting application.config.force_ssl true

It doesn't represent a valid use case. By the time that code is run
the application is already initialized so that really doesn't make any
difference. We would have to add `force_ssl` inside the
ProductsController class to make the spec pass, only that it breaks
other specs so I believe we'd rather remove it

In Rails 4 SSL application wide is taken care of a middleware called
ActionDispatch::SSL which is included on the app load. Looks like
`force_ssl` is only used on the Controller level
Fix redirect loop with redirect_https_to_http

force_non_ssl_redirect was testing if the actions was included in
ssl_{required,allowed}_actions, but didn't consider the case that it was
empty (which should mean all actions). This caused an infinite redirect
loop on admin and checkout pages with the option enabled.

This fixes the issue and simplifies the code by combining the lists of
allowed and required ssl actions. Also added some specs.

Fixes #3813