Previously, all arguments to self.request.GET.get('sort', ...) were 

passed to self.sort_list even if they were invalid. This could cause 

issues where columns collided with methods, such as when giving 

?sort=fullname to /users/ which resulted in an Error 500.
Now, in load_state(), a set of sort keys are computed based on what

columns are set sortable, and the column's db_field is only added to

self.sort_list if the corresponding column is in this set.

Two unit tests have been added to exercise this functionality in 

ascending and descending order, passing in an invalid sort key and 

checking that self.sort_list is empty. 
Two additional unit tests sort on one valid and one invalid key in 

ascending and descending order and check that self.sort_list only 

contains the valid key. All four of these unit tests pass.
All tests in djblets.datagrid.tests and 

reviewboard.datagrids.tests passed without problems.