Do not mark a payment as COMPLETE on success

The "success" method is called as a callback when the payment at paypal is finished. But there is no guarantee that the payment has been really done. An user could call himself to the success url, and the controller will mark the payment as COMPLETE.

I think that is a high security risk. The only one that should mark a payment as complete is the IPN notification.

This pull request removes the change of status at success