Refactor the duplicate request prevention code ( order.with_lock )
- break the lock code out into a seperate callback
- ensure it only operates on an update
- add specs

Refactor & Bugfix
- Correcly name the callback that prevents duplicate requests
- Add a spec to test that the callback is being called

Fixes #5523