Fix issue that caused admin users to get unassociated from an order

since update_attributes is called below with params, i wonder if it might be a bit more explicit if we do

`params.delete(:user_id) if user.try(:has_spree_role?, "admin") && params.key?(:user_id)`