prevent IO operations on closed file

cache empty tile image as bytes and not StringIO, since some WSGI servers
(gunicorn) will close the StringIO file
allow limited_to geometries in layer dict for TMS/WMTS/KML auth responses