user tracking, access control and rate limiting