Switch to poltergeist for spree_backend.

Fixes #4383
Whitelist some params for canonical links. Fixes #4374
Allow preferences to reference ENV variables.
Revert "Allow preferences to reference ENV variables."

This reverts commit a3353e247c25aa1af056fd70137b1626d3ee1059.
Clean up changelogs for 2.2.1
Remove persist_cost which is replaced with update_amounts.
Display only payment method selected partial (backend)

Drop a bunch of repeated ids on html
Display cards as per gateway on backend new payments

Otherwise users could try a transaction against a gateway which won't
understand the cc profile id
Fix payments "Use new card" toggle in backend
space
Improve support for sending client encrypted credit card data

Some users might choose to encrypt cc info on client side and not record
anything related to credit card at all on db. See Adyen Client-Side Encryption
for example
Only check if payment source has_payment_profile?

Card info might come in encrypted so number won't be present and payment
source could be something other than a CreditCard object but still
support payment profiles
add missing model translation.

Fixes #4410
Dont restart checkout_flow for completed orders

No need to destroy all shipments or set order back to first checkout
state. Currently shipments for completed orders are managed by
OrderInventory#veriry
fix race condition in order details spec

This behaved strangely because this portion of the admin displays
changes by using window.location.reload(), which wait_for_ajax doesn't
wait for (after all, it isn't AJAX). This improves the tests by waiting
for the input fields to disappear.

Should fix sporadic failures on Travis CI.
Make the extension template's default rake task run the test_app rake task if necessary

Fixes #4396
Tidy up with_property and with_property_value scope code
don't access Spree::Config[:site_url] at startup

Fixes #4421
Fix duplication of spree option values when product is cloned

Fixes #4420
Fixes #4417
[api] Attempt authorization for an order if an order token is passed

This stops the 'You must specify an API key' error message from (incorrectly) appearing. That message is now supressed if an order token is passed in.

When an order token is passed, the authorize_for_order filter is called, which attempts to find an order and then compares the order's token with the order token from params/headers