Makes specs pass on Spree 2.2.0.beta (master) (& Rails 4.0.0)

Changes include

* Use strong_parameters in RelationsController and remove the :without_protection option from #update_attributes
* Fix the ordering part of the  Product#relations_for_relation_type code