broke ApiRequestHandler down into pluggable event-based before+after workflows
added in-request caching of bans table and helper function for checking an ip or key
initial implementation of metrics
set default alert throttle to 30min
implemented endpoint rate rejections
minor syntax/reference issues
trim leading query delimiters
initial unit test for powered by header