Refactor API user loading out to own method.

This simplifies the logic around what the current user is.

There is now an assumption that the current logged in user is user to
use permissions for.  The secondary user is the user whose API key is
specified.

If both an API key are specified, and a user is logged in, the logged in
user takes precedence.

Fixes #4440
Remove authentication check.

This authentication check is performed in a before_filter only when
requires_authentication is true, so it should not be false here.

Fixes #4440
Remove order_token method.

It is specified in base_controller and is being overridden
unnecessarily.

Fixes #4440
Test order authentication.

This code was previously untested.

Fixes #4440
Authorize an order through cancan.

Fixes #4440
Integrate API key checking into authenticate_user

It doesn't really do much currently.

Fixes #4440