Rate limit access to /api/**/* to 5 per second per IP

[badlogic]

Nginx to the rescue. No page requires more than 2 API requests to load at the moment, 5 plus overflow should be enough.