Add rate limiting

This pull request adds support for rejecting incoming connections if too many goroutines are active at once, and rate limits HTTP requests from origin IPs. `RateLimitedHandler` uses a token bucket implementation ported from [`node-restify`](https://github.com/mcavage/node-restify).
It dictates whether we use `X-Forwarded-For` (vs. `request.RemoteAddr`) for origin IPs. Removing token buckets eliminates the need for this option; #86 can use `X-Forwarded-For` by default.