Add CHANGELOG entry for js responder security fix
Revert "Make sure that api requires authentication by default"

This reverts commit 1f2ff2c80bf2ba0a342cb61ebbe1b659ec0c14d4.
Update inventory after_save

It helps to work some logic with the LineItem because at that point we
would have the record id already. Main motivation here is so that
inventory units wouldn't have a line_item id nil when adding products
via backend to an order (in a product-assembly context)

Conflicts:
	core/app/models/spree/line_item.rb
Remove deprecated without_protection from specs