Depend on Rails 3.2.17
deleted products should not be available?

Fixes #4362
Fixes #4437
use authenticated url for option_type_autocomplete

option_type autocomplete wasn't using the authenticated url helper.  Updated to mirror how taxon_autocomplete
works.

Fixes #4368
Update payment state not only when order is completed

Fixes #4322
Fixes #4441
Stub out correct call in users_controller_spec to set the current user
[api] Use Rails 3 friendly syntax for authorize_for_order
[api] Stub current_api_user, not try_spree_current_user for users_controller_spec
[api] Refer to order object, not @order within LineItemsController

@order is not set in this context until the order method is called.