various upgrade shutdown logic

* refactor the rate-limit shutdown
* add --exit-on-upgrade commandline option