Implement throttling using tokenthrottle.

This moves throttling to using a token bucket implementation (using [tokenthrottle](http://npm.im/tokenthrottle)) to allow for quicker bursts while still preventing huge/prolonged spam floods.

I've replaced the threshold config variable with 3 new ones that get passed to tokenthrottle (and local.json-dist contains what are *probably* reasonable settings for them).

One downside to this module's API compared to the old method is that whether or not a request would be throttled cannot be known until we attempt to remove a token from the bucket, so I've changed the `GET /` route to always return `200`s. This might not have been that accurate anyway, given that POST requests don't happen exactly at the same time that someone is requesting the service list, so I don't think this is a huge loss.