We should impose rate limits on the API. We could use our database, but ideally we can just use something GCP or firebase provide...?