simple rate limiter implementation ( token bucket )