RequestFilter adjustments

Make the API more useful by allowing to override the response in pre-request filter so we can build rate-limiting, caching, 304 responses and so on.

Just return non-true from the pre-request handler, and the framework will try to parse it as a response value. Return SS_HTTPResponse to get that delivered to the user.

Needs some more testing - I've only checked against https://github.com/mateusz/controllerpolicy
What I mean is, in 3.1 the order is "request response model" and there is no session. What I'm suggesting is that you add session to the end, rather than move model to the 4th parameter.