In order to safely test user identification for rate limiting based on cookies in production, we need the following in the api-gateway chart:

• the name of the cookie must be configurable, so we can set it to something other than the cookie set by actual clients
• the name of the fallback ratelimit class must be configurable, so we can set it to something other than "anon", since "anon" will actually enforce rate limits.
• a special rate limit class "no-limit" that will disable rate limiting by unsetting the request headers used to construct the rate limit descriptor. If headers needed for the descriptor are missing, Envoy does not send a request to the ratelimit service and passes the request unchallanged.