add validates_attachment to Spree::Taxon icon
Fixes #4629
Base CC expiry on the rails configured timezone

Apparently ActiveSupport's .to_time doesn't respect the rails configured
timezone and instead uses the system's local timezone. This would cause
the CC to expire early in positive timezones or later for negative
offset timezones.

This is not a big issue in production (processors will reject expired
cards anyways and customers shouldn't be too upset about nearly expired
cards), but it lets my tests pass at 11pm on the 30th.

Fixes #4632
Remove unused Stock::Package#flattened

This was only used in a single test.

Fixes #4633
Dont advance order state when adding an item to cart

As of d02f67dbbf7e8ae1f61b65066c2a3a8234796a11

Admin would click to add a item to the order which would create the line
item and shipment but because we advance the order to address state the
shipments would be destroyed Order#ensure_available_shipping_rates

Cant see why we needed advance order in the first place.
Verify inventory when target_shipment is provided
Fix 500 when updating order email to something inconsistent with the associated user's email

Fixes #4614
Rename poorly named spec

Fixes #4616
There's no orders#index in spree_frontend
Lazyload variant associations in api/variants
Remove useless return in the show action from the products controller

Fixes #4635
Update CONTRIBUTING.md

Remove versions of Spree and Rails, as that info is provided by the Gemfile.
Update CONTRIBUTING.md

Require gemfile.lock too.
Refactor Shipments API & JS.

Conflicts:
	backend/app/assets/javascripts/spree/backend/shipments.js.erb
Reload order to access proper order data

Fixes #4625
Add Payment#cancel!

This is now called when an order is cancelled, and can do one of two things:

1) It will call the payment method's cancel method if it has one (BraintreeGateway is so far the only gateway to have one)
2) It will call credit! and act like cancelling an order used to

This is part two of the fix for spree/spree_gateway#145
Add missing shipments_api route in backend.js
Fix issue with stock movement routes.

The standard stock movement route depends upon stock_location being
specified. The StockMovementsController depends on a stock_location_id
being specified, so the correct stock movement route is the one nested
under stock location.

Using the non-nested route leads to an error "Couldn't find
Spree::StockLocation without an ID".

Fixes #4631
Improve Order#products and Order#variants methods

* Now they are an active record relations instead of an array
* All the hard job is done by the database engine now

Fixes #4615

Conflicts:
	core/spec/models/spree/order_spec.rb
Optimize touch_taxons on product.

This will touch all of the taxons and taxon ancestors for  a product
using a constant number of updates (2, one for taxons, one for
taxonomies).

Previously the number of updates would be 2 * the number of taxons &
taxon ancestors, as it would update the taxonmy for each taxon on each
update.

Fixes #4636
[api] Add ability to assign user_id through Orders#update

Hi, my name is associate_user. You might remember me from smash comedies like 'CheckoutsController'.