Refactoring rate limiting to ignore `Authorization` header, as it provides an attack vector