Fix api payments controller specs

They were raising "stack level too deep" due to a `payment.reload` call
inside the spec. I've removed that since we should just the request
response rather than asserting against an external object. A pending
request was added to investigate that later

Fixes #3191
Use new Rails Http::Headers env notation

As of Rails 4, see https://github.com/rails/rails/commit/e2a5de2

Fixes #3191
Include StrongParameters module into API BaseController

This required a lot of manual work but I think it should be safer. We
can move to a more abstract approach once we get used to the strong
parameters caveats

Fixes #3191
Clean up some Rails 4 DEPRECATION WARNING

Fixes #3191
StockMovements can never be altered (updated or destroyed), they can
only be created.

Related to #3191