Remove only_one_promotion_per_product validation from product promotion rule
Check for EITHER current_spree_user or spree_current_user in try_spree_current_user

I had some requests to the API from the backend which were 401'ing mysteriously... until I worked out that Devise's method is called current_spree_user. I didn't want to break backwards compatibility, so now this method just checks for either spelling of the method.