check_authorization should use params token first

in check_authorization method.
The original code is:
session[:access_token] ||= params[:token]

So once session[:access_token] has been set, I can't reset it unless I close my browser to invalidate session.

The example scenario is below.

If I had a order url with token "http://www.example.com/orders/R176458284/token/383caf1a6dd71df4"
However, I incorrectly copy and paste it to browser and open it:
"http://www.example.com/orders/R176458284/token/383caf1a6dd71"
Now I got a unauthorized 401 page, that's correct because my token is wrong.
But after that, I try the correct link again and it still won't work since session[:access_token] has already been set and won't be set again even I pass a new params[:token]

I believe the correct logic is to check params[:token] first, once params[:token] is available, session[:access_token] should always be overridden by params[:token].

Thanks.

Fixes #4791
Add spec for overriding order token
Fix failing api spec

ids aren't guaranteed to be returned in the same order, so change eq to
match_array.

Fix #4796
Welcome scope Promotion#coupons

It makes sense sometimes to only fetch promotions where a coupon code is
present
Better errors on coupon code failing

Assuming everything that wouldn't activate properly was "already
applied" doesn't work since anything that fails to activate but wasn't
"already applied" shows up to an end-user as "already applied". By
explicitly checking for coupons already applied we can put a more
generic error if activate fails.

Fixes #4781