Rework API-key/login interaction. Add request rate-limiting.