Return correct HTTP status code: 429 Too Many Requests

HTTP status code 403 is usually returned when a resource is permanently forbidden (e.g. file system access, invalid/missing client certificate). For rate limiting, send status code 429 (see RFC6585: https://tools.ietf.org/html/rfc6585#section-4).

I also added the 'Retry-After' header in the response.