Revert "Added ability to perform address actions outside scope of an order"

This code is unreachable in stock spree because there is no route to get to Api::AddressesController without going through an order.
And the unreachable code is insecure by default -- if a store did add an "/api/address/:id" route then any Api user would be able to read any other user's addresses simply by guessing the id because that's how the permissions were added in ability.rb.
It seems like it would be better to just remove this or else make it a fully supported, reachable, and secure endpoint in stock Spree.

This reverts commit 229cdf4284fa56528a06c0c86830b19a7f49c3df.

Conflicts:
	api/app/controllers/spree/api/addresses_controller.rb
	core/app/models/spree/ability.rb

Fixes #5375
Add data-hook to password fields on user form
Fixes #5377
update order shipment total on transition to delivery

Fixes #5376
Fix spec broken by ca5799d2c1b0d3f5a2ea1b695e5c7083781080cd
Bump Rails to 4.1.6

Fixes #5371
Added failed state to the admin variables

A payment state could be `failed`.
This state was missing from the admin variables.
The payment state had no color, it was just a blank circle. I added the red color.
I noticed this in spree 2-2-stable.

Fixes #5378