Move arg to Request, fix ORM, fix typos, add .htaccess updates

A couple notes on the arg stuff:
- K3 controller actions neatly take things from Request (param, query, post, url)
and put them in Response (headers, body, send_file), so arg should follow suit
instead of being in the Controller class.
- arg_required() is used 92 times and arg() just 1 time, so the syntax should
favor the much more common case.
- move Controller::arg_required() to Request::arg().
- move Controller::arg() to Request::arg_optional().

Total usage count:
5 required, no rule
74 required, digit
6 required, alpha
7 required, alpha_dash
1 optional

See the commit descriptions for more info on the other changes.