Implement rate-limiting

http://www.vinaysahni.com/best-practices-for-a-pragmatic-restful-api#rate-limiting
this should also happen in setAccount(), unless we'll inject the restful handler to the rate limit manager, so we'll always deal with the same user.