User (API key) registration, fix throttle error

This adds a two-step user registration process and fixes an
off-by-one error with throttling.

Registration starts with a GET request that results in a
registration token. This token has a lifetime of 60 seconds, and is
required when POST-ing to the registration endpoint.

This two-step process hopefully provides some assurance that the
human or machine requesting an API key knows at least a subset of
the specification before talking to the API.

Registration has the benefit of higher throttle thresholds: 50
requests per minute, up to 500 per hour. Eventually, URL statistics
and other tools will be available for registered users.