If someone does hit us with a lot of concurrent requests, our log file is going to fill up fast.    We could switch to debug, but it's important that we know about API abuse.

I think we actually need another rate limiter, to limit how often this gets logged (eg one WARN per API key per hour).