api shouldn't know about order and token

ping @makasim 

This connects with one of the comment you made in payum repo
```
this logic has to be moved out of api class, ideally to a FillPaymentDetailsAction. The api class provide a low level access it is not aware of any models , tokens security and so on.
```

let me know if it's better now. 

question: could we access api constants from fillOrderDetailsAction and maybe get ride of the completePayment Method?

Also please note i pushed a changed to the master branch related to payment urls. You were redirected to the wrong url in your yesterday tests. Was my fault. Should be ok now. 
This is not redsys code by iso4217: http://en.wikipedia.org/wiki/ISO_4217