Cleaning up XSD <-> Java
Implement rate limiting for login

We switched from Jersey to a servlet so that we could get async access.
This is not great in general, but the tighter control for login is probably a good thing.