Throttle username logins

I would just use `status.HTTP_429_TOO_MANY_REQUESTS` directly. I don't think this is any clearer and it requires looking in more places.