[frontend] Checkout now uses API to retreive (country) state information

This is then cached in a local JavaScript variable so that if they de-select a country and then re-select it, it won't make a superfluous API connection
Restrict adjustment check for promo to eligible ones in StoreController
[frontend] Clean up checkout_spec
Default the API to NOT requiring authentication

Actions where people can still modify data are protected by CanCan