credit card spec fix

fixes #4778
fix for payments made via /admin

orders placed via /admin were being charged twice.

See these two lines from Spree::Admin::PaymentsController:

    while @order.next; end
    @payment.process! if @order.completed?

For incomplete orders the first line will trigger callbacks that cause
the payment to be charged if the order reaches the "completed" state.
Then the second line will process the payment *again*, resulting in a
double charge.

We can't just remove the second line because orders that are already
complete won't trigger any callbacks from the first line, so these
orders need to have their payments charged manually.

The effect of the bug in our case was that Braintree rejected the second
(duplicate) billing on the payment, and this resulted in the Payment
object being marked as failed when actually it succeeded on the first
attempt. So it appeared from within Spree that a successful payment
was a failed payment.

Fixes #4768
Add explicit spec for double payment processing issue
The result call is checked earlier

It does nothing inside this function. and its all private. so I can
change what I want.

Fixes #4782
check_authorization should use params token first

in check_authorization method.
The original code is:
session[:access_token] ||= params[:token]

So once session[:access_token] has been set, I can't reset it unless I close my browser to invalidate session.

The example scenario is below.

If I had a order url with token "http://www.example.com/orders/R176458284/token/383caf1a6dd71df4"
However, I incorrectly copy and paste it to browser and open it:
"http://www.example.com/orders/R176458284/token/383caf1a6dd71"
Now I got a unauthorized 401 page, that's correct because my token is wrong.
But after that, I try the correct link again and it still won't work since session[:access_token] has already been set and won't be set again even I pass a new params[:token]

I believe the correct logic is to check params[:token] first, once params[:token] is available, session[:access_token] should always be overridden by params[:token].

Thanks.

Fixes #4791
Add spec for overriding order token
Fix failing api spec

ids aren't guaranteed to be returned in the same order, so change eq to
match_array.

Fix #4796