Fix security issue when updating order by API.

Fixes #5711
Spree 2.4 upgrade guides state that Rails 4.1.6 is the minimal version while gemspec of spree_core in current 2-4-stable branch depends on 4.1.8. Changed the upgrade guides to reflect that.

fixes #5707
Better gateway error handling during refund creation

Fixes #5712
Use the shipping calculators in the test factories +

The shipping calculators are similar but not the same as the calculators
used for other models; the shipping calculators are contained in the
Spree::Calculators::Shipping namespace. The shipment_method_factory
doesn't make the distinction between the two calculators.

Support the currency property on the flat rate calculator (fixes #5433)+

This enables promotions to have differing values for different
currencies, or for a promotion to only apply for a single currency.

The flat rate calculator's currency and the order's currency are
compared, if they don't match the calculator returns 0, and 0-rate
promos don't get added to orders.

Fixes #5698