Similar to #69 the amount of requests per time unit should also be limited to prevent attack vectors like ddos. This could be a dedicated middleware.