Add throttling to the user-api

This is an experiment to add request throttling to the user-api. It's not really perfect, but I wanted to put it out as an example for discussion.

In particular, I want @cheddar to look at it to see how he feels about doing this in styx instead. I could imagine throttling at the public route level rather than at the individual API level. It would probably mean additional information on burst/rate added to the route setup in styx.