[x] update tipoff/authorization to newer version with authenticatable EmailAddress
[x] update tipoff/locations to newer version with unambiguous routes
Changes cart ownership to use EmailAddress instead of User. API Controllers support either a User being authenticated ('web' guard) or an EmailAddress being authenticated ('email' guard).
Purchasing requires the EmailAddress is linked to a User account. The User account is not required until purchase is attempted.
Requirements before merge:
Changes cart ownership to use EmailAddress instead of User. API Controllers support either a User being authenticated ('web' guard) or an EmailAddress being authenticated ('email' guard).
Purchasing requires the EmailAddress is linked to a User account. The User account is not required until purchase is attempted.