Add rate limiting to API calls

[spwoodcock]

Is your feature request related to a problem? Please describe.

• After we add a task queue, Redis will be part of our stack.
• We can also use Redis to effectively handle rate limiting.

Describe the solution you'd like

• Rate limiting should be implementing based on:
  • Number of requests from an IP address per minute.
  • Possibly total number of requests per minute to avoid DDOS?

Describe alternatives you've considered

• We could add something like fail2ban to the Nginx proxy, which isn't a bad idea.

Additional context

• For most endpoint we are protected by login_required, making distributed attacks harder.
• But we do have some unprotected endpoints out of necessity, so this is a moot point.