deleted products should not be available?

Fixes #4362
Fixes #4437
use authenticated url for option_type_autocomplete

option_type autocomplete wasn't using the authenticated url helper.  Updated to mirror how taxon_autocomplete
works.

Fixes #4368
Fix Product#possible_promotions to use promotion_id, not activator_Id

Fixes #4395 an error on the product show page

Product#possible_promotions is to use `:promotion_id` instead `:activator_id` - because `activator_id` was renamed to `promotion_id`

Fixes #4416
Make Promotion#expired? always return true/false rather than true/false/nil
Remove oj dependency due to #4431

Fixes #4431
Update Order#payment_total only when saving payment

This is part of efforts to deprecate `order.update!` completely. I can't
see a reason why saving a payment would require touching stuff such as
Order#item_total for example. Plus OrderUpdater#update is very very very
expensive so we should get a lot of query improvements by not calling it
at all.

Next step to improve it could be dropping the after_save callback and
instead build our own wrapper method to save a payment and update the
order payment total. Possibly making tests faster too.
Move user admin interface over from spree_auth_devise, fill out with more information