api shouldn't know about order and token

ping @makasim 

This connects with one of the comment you made in payum repo
```
this logic has to be moved out of api class, ideally to a FillPaymentDetailsAction. The api class provide a low level access it is not aware of any models , tokens security and so on.
```

let me know if it's better now. 

question: could we access api constants from fillOrderDetailsAction and maybe get ride of the completePayment Method?

Also please note i pushed a changed to the master branch related to payment urls. You were redirected to the wrong url in your yesterday tests. Was my fault. Should be ok now. 
just ```sign```? ok to the tye hint