Show a big warning when people use protected_attributes

A lot of people have been running into issues when protected_attributes is in use, mainly because it FORCES models to have attr_accessible declared on them. This is not the default within Rails 4 engines/applications, and so we run into major problems with Spree when this gem is in use.
Make sure checkout payment only flow works

Fixes #3142
Remove Spree::LegacyUser.anonymous! and anonymous?

These methods seem to have no more use within Spree.
Add EmailValidator#valid?

This method can be used outside the scope of an AR instance to validate if an email is indeed valid or not

Used within spree_auth_devise's CheckoutController decorator as of 29d167655314961e1043ae45694528b8f364c3fc
Correct template used for backend assets in install generator

Thanks to @alepore's comment here: https://github.com/spree/spree/commit/cfbd0f3#commitcomment-4865755
make sure we load the promotion rules after initialize so the user rules are correctly saved. also remove the after_save on promotion, this is no longer needed.

Conflicts:
	core/app/models/spree/promotion.rb
[api] Passing without_children=1 to taxons endpoint will now return a 'shallow' result set without children

Fixes #4112
Only show orders/mine for persisted users
[backend] remove reference to removed anonymous? method in customer_details/form