Implement rate-limiting

http://www.vinaysahni.com/best-practices-for-a-pragmatic-restful-api#rate-limiting
I don't think account is really NULL if called from the restful handler, it's always going to be anon or auth.