Add an 'order' parameter to the /contacts API.

Only return ranked results if 'order=rank'; otherwise return results ordered by
internal ID.

Also add some validation for the 'limit' and 'offset' parameters.