Flush out lookup action.

Because we're taking control of what normally the checkout controller
might do (namely, applying a coupon code and creating a payment) we have
a lot of logic here; however, it's necessary because injecting this
logic into the checkout controller would have been worse, and a portion
of this logic can be shared with the authenticate action later.