Add rate limiting to auth