Add rate limiting

This pull request adds support for rejecting incoming connections if too many goroutines are active at once, and rate limits HTTP requests from origin IPs. `RateLimitedHandler` uses a token bucket implementation ported from [`node-restify`](https://github.com/mcavage/node-restify).
Realistically, mobile devices will probably not maintain a connection for 1 hour, but they're going to be "self-governing" due to battery forcing the connection closed, or bad connections, etc. Desktop connections of 1 hour are reasonable (unless folks are following football games or critical events, but those are edge cases and reconnections shouldn't be a problem. Speaking of reconnections, I'm also a bit concerned that this may cause a "zerg rush" when lots of clients hit the timeout at the same time and then try to immediately reconnect. We may want to add some "fuzz" around the keep_alive_period to minimize this impact.