Fix being unable to sort on custom synthetic columns.

If a sort field whitelist is used we should trust its data and also
trust that the developer wanted what they asked for. This solves issues
where it was impossible to sort on synthetic columns added in custom
find types.

Fixes #3919
Ignore asset requests containing %2e in them.

urldecode URI's early to avoid issues with encoded `.` characters.
Simplify whitelist logic.