fix race condition in order details spec

This behaved strangely because this portion of the admin displays
changes by using window.location.reload(), which wait_for_ajax doesn't
wait for (after all, it isn't AJAX). This improves the tests by waiting
for the input fields to disappear.

Should fix sporadic failures on Travis CI.
Make the extension template's default rake task run the test_app rake task if necessary

Fixes #4396
Tidy up with_property and with_property_value scope code
don't access Spree::Config[:site_url] at startup

Fixes #4421
Fix duplication of spree option values when product is cloned

Fixes #4420
Fixes #4417
[api] Attempt authorization for an order if an order token is passed

This stops the 'You must specify an API key' error message from (incorrectly) appearing. That message is now supressed if an order token is passed in.

When an order token is passed, the authorize_for_order filter is called, which attempts to find an order and then compares the order's token with the order token from params/headers
deleted products should not be available?

Fixes #4362
Fixes #4437
use authenticated url for option_type_autocomplete

option_type autocomplete wasn't using the authenticated url helper.  Updated to mirror how taxon_autocomplete
works.

Fixes #4368
Fix Product#possible_promotions to use promotion_id, not activator_Id

Fixes #4395 an error on the product show page

Product#possible_promotions is to use `:promotion_id` instead `:activator_id` - because `activator_id` was renamed to `promotion_id`

Fixes #4416
Make Promotion#expired? always return true/false rather than true/false/nil
Remove oj dependency due to #4431

Fixes #4431
Update Order#payment_total only when saving payment

This is part of efforts to deprecate `order.update!` completely. I can't
see a reason why saving a payment would require touching stuff such as
Order#item_total for example. Plus OrderUpdater#update is very very very
expensive so we should get a lot of query improvements by not calling it
at all.

Next step to improve it could be dropping the after_save callback and
instead build our own wrapper method to save a payment and update the
order payment total. Possibly making tests faster too.
Refactor API user loading out to own method.

This simplifies the logic around what the current user is.

There is now an assumption that the current logged in user is user to
use permissions for.  The secondary user is the user whose API key is
specified.

If both an API key are specified, and a user is logged in, the logged in
user takes precedence.

Fixes #4440
Remove authentication check.

This authentication check is performed in a before_filter only when
requires_authentication is true, so it should not be false here.

Fixes #4440
Remove order_token method.

It is specified in base_controller and is being overridden
unnecessarily.

Fixes #4440
Test order authentication.

This code was previously untested.

Fixes #4440
Authorize an order through cancan.

Fixes #4440
Integrate API key checking into authenticate_user

It doesn't really do much currently.

Fixes #4440
Fix case where 'Free Shipping' was incorrectly displaying

Fixes #4306
API BaseController inherits ActionController::Base

Spree::Api::BaseController now inherits from ActionController::Base.

Removed unnecessary includes

Fixes #4418