Refactor the duplicate request prevention code ( order.with_lock )

- break the lock code out into a seperate callback
- ensure it only operates on an update
- add specs
@DangerDawson. Actually this should be 'ensure_valid_order_version' isn't?