prevent brute force attacks, allow setting max requests per second