changed rate limit tracking to track user and not client rate limiting