use permitted_user_attributes to allow extension

Fixes #137
Use Spree::PermittedAttributes to set params allowed

This allow users to extend it whithout having to override that method.
e.g.

        Spree::PermittedAttributes.user_attributes.push :f_name, :l_name
Include core/user_address in User model

Give users the chance to remember user address on checkout
Use PermittedAttributes in other controllers as well

Help users extend it better
Set promotion specs as pending for now, fix other specs
update to respect the new asset namespacing

Related to spree/spree#4050

introduced here: https://github.com/spree/spree/commit/cfbd0f346ee89ea252ef3dfe8f7779ebacc3b875
Bump to Devise 3.2.2
Remove :token_authenticatable from model, as Devise 3.1 deprecated it
Remove Spree::User.anonymous!

This appears to no longer have a use within Spree itself. Orders seem content to have an email associated with them, but no user associated
Use EmailValidator.valid? to check if email is valid in CheckoutController#update_registration

Conflicts:
	app/controllers/spree/checkout_controller_decorator.rb
Remove token_authentication_key, given it is now deprecated
Return warning for when people have not configured Devise.secret_token
Remove ancient commented out code from admin/users_controller
Update user password reset to work with Devise 3.2.2

Conflicts:
	app/mailers/spree/user_mailer.rb
	app/models/spree/user.rb
Remove attr_accessible comments from User model
Order email tests already exist within core

No need to have them duplicated in auth as well
Spree::UserMailer tests now need to pass TWO arguments

Conflicts:
	spec/mailers/user_mailer_spec.rb
Remove unnecessary pending test from users_controller_spec
Fix argument list expected for reset_password_instructions in user_spec

Conflicts:
	spec/models/user_spec.rb
Clear all AM deliveries before all tests