Fixing case where add_session_order() isn't called on $0 orders

Direct result is the confirmation page shows a 404, it can't match
a requested order to an ID stored in session.

This fixes that by moving OrderManipulation::add_session_order() call
into placeOrder() instead of makePayment(), so that it's always set
regardless of whether a payment was made or not.