Associate default user address in pre-transition callback

Two advantages:

1) Centralizes this logic, as we want this to happen whether you create
an order from frontend, backend or API.

2) Waits until the last possible moment to assign an address and will
thus get the most recent default address, rather than the one at the
time the cart was created.

Make default address association safer

It turns out that the state transition itself calls a save, so there is
no need to add one more here. To make this even safer, we refuse to
associate default addresses that are not valid.

Save two queries by checking _id instead of the association

Convert to new hash syntax

Fixes #5108