Add CHANGELOG entry for js responder security fix
No need to call gemspec in common_spree_dependencies

Each component Gemfile already calls it
Add index to source columns on spree_adjustments so UpdateAdjustmentStates migration does not take ages to run on large databases

Fixes #4145
Remove ability to configure paperclip in backend

There are numerous drawbacks and "gotchas" in the current image_settings
interface than I argue are worth keeping.

Any changes you make to the settings need a server restart to actually
work. Also, any changes to styles require a rake task to be ran on the
backend. These changes must be completed by programmers and we do not
gain anything supporting them in settings versus setting them in
initializers.

Settings can still be set by using Paperclip::Attachment.default_options,
or can continue to be set on an individual attachment with:

  Spree::Image.attachment_definitions[:attachment][:url] = '/my_url/:id'

Fixes #4139
Add product.has_variants and variant.in_stock to products#show api

These two pieces of imformation are important for the API to allow clients to deliver ui/ux friendly product variant picker to users.

The product.has_variants? allows clients to determine if the product is_master variant can be selected as a purchase-able option. This is the current functionality in Spree-Frontend:

https://github.com/spree/spree/blob/master/frontend/app/views/spree/products/_cart_form.html.erb#L26

The second change is an enhancement to the API that prevents users from picking variants that are not in stock. We can X it out or shade it out to indicate that it's a possible option but not available. The urrent Spree-Frontend doesn't even check for this, and instead warns of inventory on add-to-cart. This is less than ideal if we want to prevent people from getting into this dead-end and block the selection to begin with.

* changes to product show rabl and variant base template
* tests for product and variant API specs

Fixes #4153
Include *_tax_total fields in orders API responses

Fixes #4157
Fixes #4158
Added display_ship_total to order api response

Fixes #4161
[api] Use correct amount for ship total in orders_controller_spec
Bump activemerchant to 1.42.3
Don't use hard coded assets prefix

Fixes #4156
Remove variant default_scope from Price class this fixes Price must belong to a variant when trying to fetch the price fo a deleted variant

Fixes #4169
Bump to awesome_nested_set 3.0.0.rc.3
Fix states_required references for countries that don't actually need states

See:

* http://en.wikipedia.org/wiki/Address_(geography)#Switzerland
* http://bitboost.com/ref/international-address-formats/switzerland/
* http://geneva.angloinfo.com/information/housing/post-codes/
* http://en.wikipedia.org/wiki/Address_(geography)#Malaysia

And other online sources.  May need to review additional countries referenced in d0585271b7bc8a285b7ffdbeb1af45bdfece1e22
Add inverse_of to associations between shipping methods and rates

Fixes #4168
Prevents admin js errors by ensuring taxons key in api response

Fixes #4174
Improves Api::ProductsController#create

Conflicts:
	api/spec/controllers/spree/api/products_controller_spec.rb
Fix api/products_controller spec on postgres

Conflicts:
	api/spec/controllers/spree/api/products_controller_spec.rb
Remove variants from permitted_product_attributes

Since Product don't use nested_attributes rails feature for variants
anyway. Plus add some more tweaks to make sure it's possible to pass
either a hash of variants or of option types when creating a product.
Update api/products spec to reflect new template

products/show has a specific key for the master variant
Find or create shipping_category on api/products#create

Users can send a shipping_category string on the product payload and
spree will find or create that shipping_category and associate that
category with the product. e.g.

    product: {
      ...
      shipping_category: "Free Shipping Items"
    }