[api] Use stub instead of should_receive for has_spree_role? calls

This method is now called in the Rabl responses, and may be called more than once. Therefore it's better to just stub it and have it always return that value, than to use should_receive which expects only one call
[api] Move authorize! call for OrdersController#update to AFTER @order is defined