Token bucket algorithm for rate-limiting