Limit rate of key urls with no auth