Add formal ratelimiting headers

Three headers can now be included for API requests:

X-Ratelimit-Used: Number of requests used in this period
X-Ratelimit-Remaining: Number of requests left to use
X-Ratelimit-Reset: Approximate number of seconds to end of period

Additionally, 429 responses can be returned for requests that
exceed the ratelimit.

Ratelimits are per-IP normally. OAuth clients will be
limited per user-client combo.
Remove debug logic from OAuth2ResourceController
logout.compact: Fix logout redirect.
VDestination: Add extension to default destination.
register.compact: Fix unstyled email field.
comment.compact: Implement missing show replies contest mode functionality.
multi: Fix js error on sr name hover.

Should also fix the bubble not showing up in general.
Fix /explore bubble having two anchor- classes.
r.ui.Bubble: Default to anchor-right logic.