Differentiate rate limiting for auth vs. non-auth users

Resolves #65.