[api] Use Rails 3 friendly syntax for authorize_for_order
[api] Stub current_api_user, not try_spree_current_user for users_controller_spec
[api] Refer to order object, not @order within LineItemsController

@order is not set in this context until the order method is called.