Throttle by basic auth creds

This PR gives us the ability to rate limit requests by basic auth username.

In it's current implementation, it only provides a single hourly limit for each basic auth username we want to throttle.  For example, we can do "I want to let 'app' and 'admin' users to only do 10,000 requests an hour."

We *can not* do: "I want to let the 'app' user do 12,000 requests per hour and I want the 'admin' user to have a limit of 74,000 requests per hour."
This crashes if the client gives the auth string "basic". I think this should only happen due to a malicious client, but you might want to do `Base64.decode64(b64 || '')` anyway.