Rate limiter using token bucket