Document config

If this falls out of date, it's worse than not having it at all. Mitigate this risk by leaving loud comments next to the config section of main.go asking developers to update README.md.

It'd be nice to generate this section by parsing main.go, but the effort involved in that is unlikely to pay off any time soon.

Also lower a default for rate limiting.