Add AppEngineSecurityMiddleware, fix a bug in indexing that was exposed by it