fix(user): if need to upgrade site, send 501, not 400
chore(throttling): add api-throttling (request limiting) so users can
only request routes 120times per minute (aka, 2req/second but spread out
for sanity). fixes #2645