Show a big warning when people use protected_attributes

A lot of people have been running into issues when protected_attributes is in use, mainly because it FORCES models to have attr_accessible declared on them. This is not the default within Rails 4 engines/applications, and so we run into major problems with Spree when this gem is in use.
Correct template used for backend assets in install generator

Thanks to @alepore's comment here: https://github.com/spree/spree/commit/cfbd0f3#commitcomment-4865755
make sure we load the promotion rules after initialize so the user rules are correctly saved. also remove the after_save on promotion, this is no longer needed.

Conflicts:
	core/app/models/spree/promotion.rb
[api] Passing without_children=1 to taxons endpoint will now return a 'shallow' result set without children

Fixes #4112
Only show orders/mine for persisted users
[backend] remove reference to removed anonymous? method in customer_details/form
make sure we use the proper check for checkout steps to render the shipment state

Fixes #4107
Fix issue where checkout failing on confirm step would redirect back to address step

Fixes #4117
The extension generator now uses the correct path structure for the namespaced assets. Fixed a copy/paste error in the install_generator.

Fixes #4114
Add migration to ensure shipping method categories are unique

Related to #4103
Remove duplicate join record creation

Related to #4103
Refactor shipping method creation to use a single method call

Related to #4103
Change package to return common shipping methods

* The previous code would return shipping methods that only applied
  to one of the shipping categories in the package. IMHO the more
  correct approach is to return only the shipping methods that are
  common between all the shipping categories.
* The #to_a at the end handles the case where the shipping
  categories are empty, so that an empty Array is returned rather
  than nil.

Related to #4103
Fix failing package specs in master branch

* This fixes two specs that fail due to changes in the master
  branch. One change exposes a bug in the original specs, since they
  refer to a single variant, yet variant1, variant2 and variant3
  are defined and ignored.

Related to #4103
Allow paging and order filtering on the mine endpoint

Fixes #4099
Get orders through current_api_user

From #4099
Correctly namespace paths in InstallGenerator#setup_assets
[api] Add ability to get properties by id

Fixes #4091
Create a payment for 'double clicking confirm' test in checkout_spec

This is now necessary to reach the confirm step, due to #4117
Link orders with promotions

Related to the work in #3567