Rate limits

Brute-forceable endpoints are rate limited per IP. Over the limit returns 429 with a Retry-After header. Session-gated calls (init, check, var, file) are not limited.