Vary rate limiting for auth/non-auth users

The SERRANO_AUTH_RATE_LIMIT_SECONDS, and SERRANO_AUTH_RATE_LIMIT_COUNT
settings are now supported. If these aren't supplied, they default to the
SERRANO_RATE_LIMIT_SECONDS and SERRANO_RATE_LIMIT_COUNT respectively.
Merge pull request #67 from cbmi/issue-65

Differentiate rate limiting for auth vs. non-auth users