Clarify "only_ip" anonymous rate limit behavior.

And test the fact that it doesn't actually return a response header once
the primary api key limit is gone.