spree/spree — pull request #5375 by jordan-brough (2014-09-16 14:04:00+00:00)
Title: Revert "Added ability to perform address actions outside scope of an order"

This code is unreachable in stock spree because there is no route to get to Api::AddressesController without going through an order.
And the unreachable code is insecure by default -- if a store did add an "/api/address/:id" route then any Api user would be able to read any other user's addresses simply by guessing the id because that's how the permissions were added in ability.rb.
It seems like it would be better to just remove this or else make it a fully supported, reachable, and secure endpoint in stock Spree.

cc @dustineichler (since he opened the original PR adding this) -- since this obviously doesn't work for out of the box, is there any reason that any of these required changes couldn't all just be added external to Spree wherever you're adding the other missing pieces?

This reverts commit 229cdf4284fa56528a06c0c86830b19a7f49c3df.

Conflicts:
api/app/controllers/spree/api/addresses_controller.rb
core/app/models/spree/ability.rb