Remove duplicated api update shipments controller method

Fixes #2864
No need to pass AUTHENTICITY_TOKEN to API requests in taxonomy.js
Use Spree.url to create a URL with a token parameter in variants_autocomplete.js
Use Spree.url in adjustItems for variant_autocomplete.js
Support empty query parameters for Spree.url