Allow for more open-ended throttling.

We can look up usernames from JSON request bodies, and will simply
return 429 for requests that don't map to django templates.