Add control to how api key rate limits are applied to anonymous users.
Clarify "only_ip" anonymous rate limit behavior.

And test the fact that it doesn't actually return a response header once
the primary api key limit is gone.
Merge branch 'master' into gsa