check_authorization should use params token first

in check_authorization method.
The original code is:
session[:access_token] ||= params[:token]

So once session[:access_token] has been set, I can't reset it unless I close my browser to invalidate session.

The example scenario is below.

If I had a order url with token "http://www.example.com/orders/R176458284/token/383caf1a6dd71df4"
However, I incorrectly copy and paste it to browser and open it:
"http://www.example.com/orders/R176458284/token/383caf1a6dd71"
Now I got a unauthorized 401 page, that's correct because my token is wrong.
But after that, I try the correct link again and it still won't work since session[:access_token] has already been set and won't be set again even I pass a new params[:token]

I believe the correct logic is to check params[:token] first, once params[:token] is available, session[:access_token] should always be overridden by params[:token].

Thanks.

Fixes #4791
Add spec for overriding order token
Fix failing api spec

ids aren't guaranteed to be returned in the same order, so change eq to
match_array.

Fix #4796
Welcome scope Promotion#coupons

It makes sense sometimes to only fetch promotions where a coupon code is
present
Better errors on coupon code failing

Assuming everything that wouldn't activate properly was "already
applied" doesn't work since anything that fails to activate but wasn't
"already applied" shows up to an end-user as "already applied". By
explicitly checking for coupons already applied we can put a more
generic error if activate fails.

Fixes #4781
Refactor stock transfers variant select JS - Allow user to search for a variant by name or SKU, rather than just returning the first 25 items from a stock location

Closes #4795
update the default email template to include all the proper taxes, shipments and adjustments

Fixes #4798
Update payment risk assessment, and fix broken specs. Fixes #4630
Ensure shipments are also destroyed when the order is emptied.

Conflicts:
	core/spec/models/spree/order_spec.rb
drop credit_cards first_name and last_name fields

It was intended for this to happen eventually.
It's been causing confusion for us and some others in a couple ways so it seems like a good time to drop them.

Fixes #4787
Re-choose best available promotion when an order changes

Before this change, we could end up with multiple eligible promotions on
the same order. This happened because changing the order (for example,
by adding line items) rechecked the eligibility of promotions,
potentially making multiple ones eligible, but forgot to re-choose the
one best promotion.

This change adds a call to the logic that chooses the best promotion any
time the ```OrderUpdater``` recalculates adjustments.

Adds test to ensure we do not apply multiple line item promotions

Spec and style improvements

Runs two specs twice with different ordering to ensure the order in
which promos are applied doesn't matter. Also cleans up some style
issues and removes an unnecessary stub.

Add specs for taxable items + promos

Correctly limit a promotion to its maximum amount

You should never be able to reduce the price of an adjustable to less
than zero. Thus, we have to guard against a promo applying a discount
larger than the pre-promo amount.

However, as we also do recalculations, we cannot just use the
post-adjustment amount as a limit here. We have to use the
pre-adjustment amount -- i.e. pre-tax, pre-promotions. That is correct
because a) tax gets calculated on the post-promotion amount and b) there
can only be one active promo per line item.

fix for line_item amount instead of price with associated spec

Conflicts:
	core/spec/models/spree/promotion_handler/coupon_spec.rb

CreateItemAdjustments handles only LineItems

Fixes #4675
Fixes #4775
Fixes #4799
Payments with a cvv_response_message are not necessarily risky.
Remove spec that is no longer true.
make sure we fail fast and exit when a spec fails
Javascript fixes for IE8.

Conflicts:
	core/app/views/spree/shared/_routes.html.erb
Loosened the version required for select2-rails.

This version of select2-rails relies on sprockets ~> 2.0.0 (via sass-rails) whereas rails (~>4.1.0) relies on sprockets-rails (~>2.0) which relies on sprockets (2.12.1). A later version of select2-rails removes the dependency on sass-rails, which fixes the dependency conflict.

Tightened up version range for select2-rails.

My previous change would have allowed major version changes. Version 3.5.0 of select2-rails was the first version to not include sass-rails.

Fixes #4804
Update backends adjustments controller to fix order.update! call.

Fixes #4599
Fixes receiving RMA's when inventory tracking is turned off.
Dont destroy all order payments in api/checkouts

Can't see why we would do that, no spec coverage or git history to
explain that behaviour either

Conflicts:
	api/app/controllers/spree/api/checkouts_controller.rb

Fixes #4424
Improving performance of migration add_line_item_id_to_spree_inventory_units

I noticed when I ran these commands on the console that the line

    shipments = Spree::Shipment.includes(:inventory_units, :order)

would load a tremendous amount of stuff from the database, negating the performance savings by the `find_each` method. This may even be a Rails bug. Putting the `includes` and the `find_each` into the same line fixed performance issues immediately.