Flush out lookup action.

Because we're taking control of what normally the checkout controller might do
(namely, applying a coupon code and creating a payment) we have a lot of logic
here; however, it's necessary because injecting this logic into the checkout
controller would have been worse, and a portion of this logic can be shared
with the authenticate action later.