Add functionality to limit access based on IP or HTTP Referer.

This access can be restricted at either the API level or user level.
In the user case, the limitations are additive to whatever the API
settings are (so a user can't be granted access to an API that's more
restrictive).