simple implementation of email rate limiting

This is Phase 0 of an abuse mitigation strategy. It stubs in the functionality to limit API calls based on email address. The implementation of `check` and `fail` are quite naive and there's no persistence or shared data between processes, but its better than nothing ;)

The parameters were chosen arbitrarily as constants because this is an interim implementation. There is a new stat log line for tracking its usage of `spam` (email limit reached) and `flagged` (failed login limit reached)

Phase 1 will move the `check` and `flag` calls to a remote service that can implement the functionality more thoroughly.