[api] Require authorization to update an order
CreditCard model will now validate that the expiry is not in the past
Changelog entry for 549d5de4ea9fb3709de140cf12a72c51e1181dc2
[api] Include selected_shipping_rate in responses for shipments
[api] Correctly parse payment information in Checkouts API

What was happening before was that the parameters were expected to be something like:

     params[:order][:order]

Which you and I both know is just plain wrong.

There were no tests for this particular part of the Checkouts API, so it escaped our notice... until now. There are tests now.

The way I found this was by building spree-marionette and trying to submit payment information to the API, and it would return a $0 amount for the payment... which seemed very wrong.

This is now all fixed.
Return *useful* errors when a payment's source fails validation

No more 'source is invalid' nonsense
[api] Remove redundant tests from return authorizations controller spec