Optional rate limiting for token auth