[DO NOT MERGE] Allow customers to create a return authorization through the API

Changes the authorization logic to allow the order’s owner to create a new return authorization.
are we submitting this to Spree? if so then we probably want to add a preference for thisi right? if not can we put it in spree-backend instead?