Allow setting a timeout for request handling

This is a high-level timeout for the http.Handler application code,
not a low-level network timeout.