Client-server API endpoints are now properly ratelimited for unauthenticated requests. Contributed by @ginger.