Allow rate limiting by user id, not just ip

[evanmcneely]

At the time of writing, the express rate limiter function is rate limiting requests by IP address by default. Add a configuration option to allow the developer to throttle requests by user ID or some other 'uuid'.