Rate limiting (max 500 requests per IP per hour)