Stringify api_key

By default there is no api key generated. I just managed to break into api on test installation using `?token[]`, one of my favourite CVEs
@radar, please take a look at Mr. Outsider's PR

Fixes #2492
tidy up spree preferences testing support
[api] Added a CheckoutsController
- Allows creation of a new, empty order
- Can transition an order from cart to complete state
- Removed now unneeded address and delivery actions from API's
  OrdersController
[api] Added support for updating an order's payments using CheckoutsController
move rabl configure into after_initilize block to fix rails generator
error
Added Users controller to API
WIP Ability changes to allow record level permissions
Add instance level permissions in Admin controller  /
ResourceController, and encourage more use for CanCan's
accessible_by method. Re-adds ability specs that were in
spree_auth_devise
Drop debugger
Drop admin user controller
Show variant images in admin/images if that's all there is

Fixes #2228

fix
Allow a returned item to be re-shipped

Fixes #2475
Fix clearing floats on admin/shipping_methods _form partial. Fixes #2472
Fix broken split prices migration.

The migration will attempt to populated spree_prices with
the variant price.  Unfortunately, since variant price is
now delegated to spree_prices, it will come back as 0.

Instead of reading from the variant price method, it's
going to set the price based upon the actual column value.

Fixes #2477
Fix SEO title again

Related to #1912 + 8eff78f1acc85194ce9e5289a8bf9159da447fdf
Remove call to authorize! which is actually not doing anything

Thanks to @laurens
Add : to adjustment label output in orders/form

Related to #2482
Fix broken link for general settings in general_settings/edit

Fixes #2469
Do not assign params in ResourceController#build_resource

Assign params in ResourceController#create instead (same location as ResourceController#update)

Fixes #2483
Introducing sortable product properties.

Fixes #2464