Fixes #25 and #26

Developers can now sign up for an account (email is required and has to be confirmed), and can register applications. When an application is registered, a random API token is automatically generated and displayed.

The rate limiter now checks for an `X-API-Token` header with a token that matches one belonging to a registered application. If it finds it, then it grants the application 5000 requests per hour. Otherwise, the client gets 60 requests per hour.