Make sure that api requires authentication by default

Fixes #4096

Conflicts:
	api/app/models/spree/api_configuration.rb
Load promotion rules after app initialization

So that they can make proper use of `Spree.user_class` which is only
defined on the app spree.rb initializer

Fixes #3152
Fixes #4113
Improves Api::ProductsController#create

Conflicts:
	api/spec/controllers/spree/api/products_controller_spec.rb
	core/app/models/spree/variant.rb
Fixes duplicate OptionTypes on Api::ProductsController#create
Fixes products_controller_spec

Conflicts:
	api/spec/controllers/spree/api/products_controller_spec.rb
make sure we sanitize the coupon_code input
refactored the find_promo_for_coupon_code and added spec