Refactor API user loading out to own method.

This simplifies the logic around what the current user is.

There is now an assumption that the current logged in user is user to
use permissions for.  The secondary user is the user whose API key is
specified.

If both an API key are specified, and a user is logged in, the logged in
user takes precedence.

Fixes #4440
Remove authentication check.

This authentication check is performed in a before_filter only when
requires_authentication is true, so it should not be false here.

Fixes #4440
Remove order_token method.

It is specified in base_controller and is being overridden
unnecessarily.

Fixes #4440
Test order authentication.

This code was previously untested.

Fixes #4440
Authorize an order through cancan.

Fixes #4440
Integrate API key checking into authenticate_user

It doesn't really do much currently.

Fixes #4440
Fix case where 'Free Shipping' was incorrectly displaying

Fixes #4306
API BaseController inherits ActionController::Base

Spree::Api::BaseController now inherits from ActionController::Base.

Removed unnecessary includes

Fixes #4418
Ensure correct Responder / responses are being sent out in the API

Now that we've switched to using ActionController::Base for Spree's API controllers, there was an issue where Spree's API responder was being an ignored, which is now fixed with the changes to respond_with

Unfortunately this broke the custom template stuff, which there were tests for within zones_controller_spec. This functionality is fixed by the override of api_behavior within the RablTemplate module. This method was calling out to ActionController::Renderers and was rendering stuff using code like resource.to_json, which is terrible. What we wanted it to do is render the proper template, and it was only by accident that I found out that doing nothing in that method causes it render the damn default template.

Happy accidents are fun.
Remove only_one_promotion_per_product validation from product promotion rule
Check for EITHER current_spree_user or spree_current_user in try_spree_current_user

I had some requests to the API from the backend which were 401'ing mysteriously... until I worked out that Devise's method is called current_spree_user. I didn't want to break backwards compatibility, so now this method just checks for either spelling of the method.
Stub out correct call in users_controller_spec to set the current user

Conflicts:
	api/spec/controllers/spree/api/users_controller_spec.rb
Implicitly set responder for Spree::BaseController

This ensures that Spree::Responder (rather than ActionController::Responder) is used
Load all line_items for an order

Instead of loading a single line_item, then loading the rest of the
line_items when updating the order, load all of the line_items and pick
out the one being updated / destroyed.

Fixes #4427
Remove typecasting from Spree::Preference

* Remove typecasting from Spree::Preference

Value is always serialized (even strings) as of 2723636. Since value is
converted upon assignment, I believe it had no effect.

* Remove Spree::Preference.value_type

Now unused since typecasting on Spree::Preference removed. There is no
need to store this (values are already serialized in the correct type).

Also removes the .valid scope on Spree::Preference. All
Spree::Preferences should be valid because they have passed migrations.

* don't pass type into preference store
* remove Spree::Preference.raw_value

Fixes #4373
Refactor Preferable#preferences

Extracts finding preference names into Preferable#defined_preferences.
And searches methods for preferred_*=, as I intend to remove
.prefers_*?.

Fixes #4373
Remove unused preference methods

This removes several methods which were never used.

* remove prefers_color?, prefers_color=
* remove prefers(:color)
* remove preferred(:color)
* remove preference_description(:color)
* remove preferred_color_description
* remove remove_preference

Fixes #4373
Preferences::Store quacks like a Hash

Preferences::Store#get (now aliased as #fetch) now behaves similarly to
Hash#fetch or Rails.cache.fetch. That is, in the event of a miss (the
preference is not yet defined), a block will be yielded and the result
of the block cached and returned.

This allows the defaults of preferences to be defined as a proc.

Fixes #4373
Don't access Spree::Config[:currency] at startup

Fixes #4373
access preferences via Preferences::ScopedStore

Objects including Preferable now always access preferences in the same
way through #preference_store, which returns an object responding to
fetch, []=, delete. This moves the responsibility of storage method
out of the object itself

ScopedStore is a proxy to the underlying cache store which adds a prefix
and suffix to the keys.

Fixes #4373