Dont send a HTTP POST when removing non-persisted nested fields

Fixes #3204
Specify class names for line_items, payments and shipments associations in Order model

Had an issue in the API when attempting to send (invalid) parameters through for line items it was throwing 'uninitialized constant LineItem'. Figured I'd go the nuclear option to solving this problem.:
[api] Require authorization to update an order through the API
Wrap permalink saving in a with_lock block to lock the table during updating

In addition, only select the permalink field from the table when querying all similarly-prefixed permalinks

This should prevent duplicate permalinks being generated by different processes hitting the database at the same time.

Fixes #2714
Only trigger spree.user.signup event when session[:spree_user_signup] and @order are set

This fixes the test for #836 within spree_auth_devise's
promotion_adjustments_spec.
Click on confirmation in order_details_spec which is now required due to 337cdf17e40542c3d5c6dda442154beee75b8206