OrderPopulator doesnt have to call shipment update as OrderContents handles that.
Use email regex from Devise. Fixes #5368
Revert "Added ability to perform address actions outside scope of an order"

This code is unreachable in stock spree because there is no route to get to Api::AddressesController without going through an order.
And the unreachable code is insecure by default -- if a store did add an "/api/address/:id" route then any Api user would be able to read any other user's addresses simply by guessing the id because that's how the permissions were added in ability.rb.
It seems like it would be better to just remove this or else make it a fully supported, reachable, and secure endpoint in stock Spree.

This reverts commit 229cdf4284fa56528a06c0c86830b19a7f49c3df.

Conflicts:
	api/app/controllers/spree/api/addresses_controller.rb
	core/app/models/spree/ability.rb

Fixes #5375
Add data-hook to password fields on user form
Fixes #5377
update order shipment total on transition to delivery

Fixes #5376
Fix spec broken by ca5799d2c1b0d3f5a2ea1b695e5c7083781080cd
Bump Rails to 4.1.6

Fixes #5371
Added failed state to the admin variables

A payment state could be `failed`.
This state was missing from the admin variables.
The payment state had no color, it was just a blank circle. I added the red color.
I noticed this in spree 2-2-stable.

Fixes #5378
Only present promotion codes that have been applied in the admin interface, and use pluck rather than collect to load the promotion name and id

Fixes #5379
Fix spec broken by d0615f8
Don't process refunds created with a transaction_id

If a transaction id exists, presumably it has already been processed.
This comes in handy when migrating over records from another system.

Fixes #5381
Bump active merchant and fix broken spec.
add select2 call after loading new images
Fixes #5385