Fix security issue when updating order by API.

Fixes #5711

Conflicts:
	api/app/controllers/spree/api/base_controller.rb
More security updates

Similar to the one for BaseController. I don't think anything actually ended up being vulnerable here but this is better anyway.
Move method to class attribute

To make it easier/cleaner to override in our app.
Allow customers to create a return authorization through the API

Changes the authorization logic to allow the order’s owner to create a new return authorization.