(bug 35727) mw.Api ajax() should put token parameter last.

(bug 35727) mw.Api ajax() should put token parameter last.

Patch from Russell Blau.

As recommended in [[mw:API:Edit#Token]], the "token" parameter in
a request should always be passed at the end of the query string.
This is a safety measure in case transmission of the HTML request to
the server is interrupted; then the server will not process the
incomplete request because there will be no (complete) token.
(Conversely, if the "text=" parameter were last, the server would have
no way of knowing whether the complete text had been received.)
Presumably the same thing is necessary for action=email, since the
request may include text of arbitrary length.

Change-Id: Id267dd628eb93eb06191c55eb386b1893f499554