verify if a user can fire a following event on order or not

Fixes #3818
Reload rules select2 box after picking a PromotionRule

So that the chosen rule no longer is displayed on the select2 box, users
can associate each rule only once with the promotion

Fixes #3572
Fixes #3816
Don't convert list of stock items to an array if all we need to do is sum
Fix redirect loop with redirect_https_to_http

force_non_ssl_redirect was testing if the actions was included in
ssl_{required,allowed}_actions, but didn't consider the case that it was
empty (which should mean all actions). This caused an infinite redirect
loop on admin and checkout pages with the option enabled.

This fixes the issue and simplifies the code by combining the lists of
allowed and required ssl actions. Also added some specs.

Fixes #3813
changed to use display_price whenever possible to allow extension and to simplify code

Fixes #3822
Accept source attributes in PaymentsController to fix backend payment processing.
Add process method to BogusSimple gateway to be able to process payments.

Fixes issue where hitting "process" on payments screen breaks with
BogusSimple gateway.
[backend] Remove unnecessary top-level admin route for adjustments
Account for adjustments with nil sources in UpgradeAdjustments migration
Skip PromotionAction adjustments if originator is nil
2 Migrations to ease in the upgrade from 1.3 -> 2.0 * Assign a shipping category to existing products & shipping methods if they don't have one * Migrate old shipping calculators to the new ones and preserve their preferences

Fixes #3605
Fixes #3660
Must set calculable before saving new calculator in MigrateOldShippingCalculators migration, otherwise MySQL screams
Temporarily make originator association available in UpgradeAdjustment migration
Add FreeShipping calculator back to ease migration from earlier Spree versions
Only remove spree_credit_card fields if they exist

I encountered a situation today on a database where these fields did not already exist. Best to have some kind of catch in place to not make the migration bomb out if the fields do not exist.
Use Spree.url() to add tokens to API calls to stock_locations

On 2.0, stock_locations AJAX class are getting a 401 on http://localhost:3000/admin/stock_transfers/new since securing the stock locations API end points.

Fixes #3828
remove unnecessary routes block in c_h/ssl_spec

rails 4 doesn't rely on routes for it's force_ssl