It should be possible to use a string when defining order_by for a ReferenceSet

I want to define the order_by property of a ReferenceSet as a string
to work around circular dependencies. For example, this doesn't
work:

class Account(Storm):

    id = Int(primary=True)
    users = ReferenceSet(id, "User.account_id", order_by="User.name")

It doesn't work because the value passed to order_by is not handled
by the property resolver. It's stored and passed directly to
ResultSet.order_by which, in the case of a string, injects the value
directly into the generated SQL (which might even make it possible
to create a SQL injection attack). A hack workaround for the issue
is to use a Column expression:

class Account(Storm):

    id = Int(primary=True)
    users = ReferenceSet(id, "User.account_id",
                         order_by=Column("name", "user"))