Change rate limiting to be per-client

[LeftofZen]

Currently the rate limiting is global. This works but it means one single user can DoS the entire service. A per-client rate limiting implementation would mostly solve this issue.