Really fix shipment number generation

Fixes #4063

(really)
Make sure that api requires authentication by default

Fixes #4096
make sure we load the promotion rules after initialize so the user rules are correctly saved. also remove the after_save on promotion, this is no longer needed.
[api] Passing without_children=1 to taxons endpoint will now return a 'shallow' result set without children

Fixes #4112
make sure we use the proper check for checkout steps to render the shipment state

Fixes #4107
Fix issue where checkout failing on confirm step would redirect back to address step

Fixes #4117
Create a payment for 'double clicking confirm' test in checkout_spec

This is now necessary to reach the confirm step, due to #4117
removing commented <h2> on admin area

Fixes #4109
Only count eligible promotions towards Promotion#credits

Fixes #4120
Add CHANGELOG entry for js responder security fix
Revert "Make sure that api requires authentication by default"

This reverts commit d24c36b95eb2db5095e09945ecc90f521d7f4f78.
Update inventory after_save

It helps to work some logic with the LineItem because at that point we
would have the record id already. Main motivation here is so that
inventory units wouldn't have a line_item id nil when adding products
via backend to an order (in a product-assembly context)
Merge branch '2-0-stable' of github.com:spree/spree into 2-0-stable