Use Spree.url() to add tokens to API calls to stock_locations

On 2.0, stock_locations AJAX calls are getting a 401 on http://localhost:3000/admin/stock_transfers/new since securing the stock locations API end points.