Rate Limiting

[DavidBuchanan314]

Given the single-user use-case, we don't have to care much about rate limiting authenticated requests (we can assume the authed user is trustworthy)

But, for any unauthed endpoints, particularly those that trigger outbound traffic (e.g. appview forwarding), we should be careful not to allow spammy requests.

If the AppView ratelimits us, for most cases we're probably fine to forward its response (including rate limit headers) back to the client.

[DavidBuchanan314]

We should maybe still think about ratelimits for auth'd requests, wouldn't want e.g. a buggy client to cause mayhem