[api] Add ssl_allowed to base_controller

Fixes #2665
Fixes #2696
Simplify tabs for incomplete order.

The tabs which did something different for an incomplete order vs. a
complete order led to a lot of confusion.

The javascript form submit would also cause some confusion in
functionality.  If for example, I was on "Order Details" and clicked on
the "Payments" link, the "Order Details" form would be submitted, and I
would be taken to the "Customer Details" page, when I actually wanted
to go to the "Payments" page.

Fixes #2704