Add rate limiting

This pull request adds support for rejecting incoming connections if too many goroutines are active at once, and rate limits HTTP requests from origin IPs. `RateLimitedHandler` uses a token bucket implementation ported from [`node-restify`](https://github.com/mcavage/node-restify).
Naming here is a little odd, maybe 'default.endpoint'? Since its where the endpoint is hit. Or maybe it just reads oddly, maybe defaults.endpoint and defaults.websocket above?