Fixed tests

- Adapt tests to new global_config arg for run_dbupdate
- Account for [plugins] not being set in config
Fixed ?next=<url> argument for require_active_login

It now includes the full URI, including GET args, not just the path.
Added CORS headers to API json_response
API: Fixed media file URLs, limits

- Added default limit and limit arg to get_entries
- Fixed URL generation for BasicFileStorage files in API