Rack::Attack.new should return an instance of a class, not the Rack::Attack constant

Because Rack Attack overrides `.new` and stores `@app` in a class variable, any future `use Rack::Attack` calls override the `@app` that Rack Attack has a reference to. For example, we had a spec that looked like this:

```ruby
  let(:app) {
    Rack::Builder.new {
      use Rack::Attack
      run lambda {|env| ok_response }
    }
  }

  it { ... }
```

When our rails app loads with `Rack::Attack` in the middleware chain, `Rack::Attack.instance_variable_get('@app')` is our rails app. After this spec has run, `Rack::Attack` has replaced its reference to our rails app with this new app and always returns the `ok_response` defined in the spec.

I would expect `Rack::Attack.new` to return an instance of `Rack::Attack`, not the `Rack::Attack` constant.