Added "sort" parameter to query processing

[andreysolovyov]

The sort parameter passed to cursor on final step. Query parameter using "-" prefix to identify sorting direction.

[boutell]

This is a good idea but we can't let arbitrary sort parameters be passed to mongodb, it can result in a denial of service very easily if there are enough documents and the specified sort is not indexed. It could also reveal hints about information not intended for API consumption.

There would need to be a process for whitelisting specific sorts (with their sort directions) to be permitted in API calls, and for specifying multiple-field sorts, like lastName,firstName, which MongoDB also supports.

It would need to work similarly to the mechanism for declaring fields safe for "distinct" calls via the API.