Add CHANGELOG entry for js responder security fix
Improves Api::ProductsController#create
Fixes duplicate OptionTypes on Api::ProductsController#create
Fixes products_controller_spec
api/products variants spec shouldn't depend on order
Find or create shipping_category on api/products#create

Users can send a shipping_category string on the product payload and
spree will find or create that shipping_category and associate that
category with the product. e.g.

    product: {
      ...
      shipping_category: "Free Shipping Items"
    }
botsy insult Washington
Only inject requirements for api, backend + frontend if extensions require them
Ensure that completed payments are automatically refunded when an order is cancelled