Make sure that api requires authentication by default

Fixes #4096
Only count eligible promotions towards Promotion#credits

Fixes #4112

Conflicts:
	core/app/models/spree/promotion.rb