[api] Attempt authorization for an order if an order token is passed

This stops the 'You must specify an API key' error message from (incorrectly) appearing. That message is now supressed if an order token is passed in.

When an order token is passed, the authorize_for_order filter is called, which attempts to find an order and then compares the order's token with the order token from params/headers

Conflicts:
	api/app/controllers/spree/api/base_controller.rb
Authorize an order through cancan.

Fixes #4440
silence Variant#in_stock? warning for correct usage

See comment here: https://github.com/spree/spree/commit/a7e6bc1#diff-f61dbf6358707ede7a8f24c85692baa5R147

It looks like it's still OK to call in_stock? without any arguments. If that's true then let's not print a deprecation notice when the method is called without arguments.
fix N+1 query performance issues on TaxRate.match method

Conflicts:
	core/app/models/spree/tax_rate.rb
Fix deprecation warning.
Add index to spree_orders for user_id & created_by_id

Addresses potential performance regressions discussed at #4582 in the last_incomplete_spree_order method arising after that method changed in c455e1a

Fixes #4584
Deprecates the Order#between method for created_between and completed_between

Addresses the discussion in https://github.com/spree/spree/issues/4554

Fixes #4597