fixes bug 976731 - Using a valid API token should change how the rate limiter works

@AdrianGaudebert r?
(cc @rhelmer)

This puts the default rate limit back to 10/min and from now on you need to use an API Token to bypass that limit. And you can't create a API token (with or without permissions attached to it) unless you have some permissions at all.