appengine: servlet: fix field initiaisation order

Otherwise supportedTypes gets set to null rather than the list of supported
types
appengine: supply a useful error message when no request is specified
test: fix warnings in NigoriServletTest
test: add test for request missing
appengine: add cors headers

This is so that we can access nigori from javascript/dart running in a
web browser that was downloaded from a different domain from the one which
nigori is running on - which is required if we ar not to trust the storage
provider.
rfc: add TODO for listing mimetypes