Clean up changes to auth_throttling middleware.

Delay function can be supplied, but it is optional. A default delay
function is provided. Some of the functions used to do throttling are
now exposed, so that they could be used to do throttling outside of the
middleware.