add support for a sort query option

Code and tests are pretty self explanatory, though there are two considerations to be made:

* Currently if you pass in an invalid sort column the query will fail. Should it instead check in list.js whether the column is a valid attribute instead of passing it on to SQL? And should it just return a full list if the "sort parsing" fails, rather than executing the query and returning a 500?

* Ascending sorts are marked by the absence of a '-' symbol, generally (as I've seen) these are explicitly either + or -, i.e. -username == DESC, +username == ASC. '+' is reserved in queries for spacing which is why I omitted it here, but we could require it through urlencoding