Refactor the duplicate request prevention code ( order.with_lock )

- break the lock code out into a seperate callback
- ensure it only operates on an update
- add specs