Set created_by for orders when associating a user if created_by is blank

Fixes an issue introduced by the addition of created_by (and associated logic) to Order.  If an Order is created by a visitor, and that visitor is subsequently authenticated as a user, then the created_by for the Order should be set to the authenticated user.   Specific changes:

1. Sets created_by for orders when associating with a user IF the created_by value is blank.  
2. Adds specs for both cases - created_by blank and created_by set to another user.

Fixes spree/spree_auth_devise issue - https://github.com/spree/spree_auth_devise/issues/120