Make sure checkout payment only flow works

Fixes #3142
Add note about asset renaming (#4050) to Core changelog
Really fix shipment number generation

Fixes #4063

(really)

Conflicts:
	core/app/models/spree/shipment.rb
	core/spec/models/spree/shipment_spec.rb
Add delivery method for applying mail settings

This allows changes to mail settings to be applied without a server
restart.

Spree::Core::MailMethod reads mail settings from config at each delivery
and initializes a new instance of Mail::SMTP with those settings to
perform the actual delivery. It also skips delivery if
Config.enable_mail_delivery is false.

MailSettings.override! now just sets the delivery method to :smtp
Don't access :allow_ssl_in_* during initialization

Fixes #4094
make sure we search for a downcase coupon code, since that's what the order is sending.

Fixes #4081
Make sure that api requires authentication by default

Fixes #4096
Remove Spree::LegacyUser.anonymous! and anonymous?

These methods seem to have no more use within Spree.
Add EmailValidator#valid?

This method can be used outside the scope of an AR instance to validate if an email is indeed valid or not

Used within spree_auth_devise's CheckoutController decorator as of 29d167655314961e1043ae45694528b8f364c3fc
Show a big warning when people use protected_attributes

A lot of people have been running into issues when protected_attributes is in use, mainly because it FORCES models to have attr_accessible declared on them. This is not the default within Rails 4 engines/applications, and so we run into major problems with Spree when this gem is in use.
Correct template used for backend assets in install generator

Thanks to @alepore's comment here: https://github.com/spree/spree/commit/cfbd0f3#commitcomment-4865755
make sure we load the promotion rules after initialize so the user rules are correctly saved. also remove the after_save on promotion, this is no longer needed.

Conflicts:
	core/app/models/spree/promotion.rb
[api] Passing without_children=1 to taxons endpoint will now return a 'shallow' result set without children

Fixes #4112
Only show orders/mine for persisted users
[backend] remove reference to removed anonymous? method in customer_details/form
make sure we use the proper check for checkout steps to render the shipment state

Fixes #4107
Fix issue where checkout failing on confirm step would redirect back to address step

Fixes #4117
The extension generator now uses the correct path structure for the namespaced assets. Fixed a copy/paste error in the install_generator.

Fixes #4114
Add migration to ensure shipping method categories are unique

Related to #4103
Remove duplicate join record creation

Related to #4103