rate limiting and auth token