Add rate limiting

This pull request adds support for rejecting incoming connections if too many goroutines are active at once, and rate limits HTTP requests from origin IPs. `RateLimitedHandler` uses a token bucket implementation ported from [`node-restify`](https://github.com/mcavage/node-restify).
Looking at this further, I think we can dispense with the error check...`request.RemoteAddr` is [set by](https://code.google.com/p/go/source/browse/src/pkg/net/http/server.go?name=release#426) Go's `http` package, and `RemoteAddr()` is guaranteed to return a valid `net.Addr` struct.