rate-limit initial implementation

Added/Changed:
1. rate-limits for secure API endpoints
2. added redis dependency. Updated project to work on Heroku but didn't tested it there.
3. rate limits can be customized though the config file

Open questions:

1. Maybe we shouldn't have rate-limits for admins?
2. Login endpoints are not rate-limited. Should discuss strategy in more details