Section on API keys

At @seanherron's [suggestion](https://github.com/18F/api-standards/pull/27#issuecomment-47024698), I added a section on API keys.

It explicitly doesn't take a position on whether or not an API should use keys, but says that if an API uses keys, it should allow unauthenticated use of the API under reasonable rate limits.

Feedback desired on this one before merge. (This is a PR to the existing #27 PR, to the `rewrite` branch.) /cc @arowla @kaitlin especially.