Remove examples and discourage password as key value

[jsocol]

There are some potential risks around using key='post:password', especially with cache stores like Redis that make it possible to enumerate cache keys. @willkg and I decided to replace those examples with a note similar to

We don't recommend creating ratelimit keys using any kind of secrets like passwords, api keys, aws keys, private keys or things like that. The way ratelimit works means that those things would come in as strings, get md5 hashed and then stored in your cache backend creating a virtually-plain-text copy of secret things in your cache backend. That's a terrible situation to be in security-wise. Don't do it.

[mlissner]

The current docs give basically the opposite conclusion and say:

Key values are never stored in a raw form, even as cache keys.

That tipped me off to this being an issue because I realized that pbkdf2 would be too slow to do with every request and that any fast solution would be a risk. From there I dug into the code to see how this was handled and was pretty dismayed to find the md5 code.

I hope this can be addressed urgently. It's only a documentation issue.

[willkg]

@mlissner PRs welcome!