Apply query.order_by before applying limit/offset in api/filtering.py

Otherwise the call fails with a sqlalchemy InvalidRequestError. Fixes T159.