rate limit requests by IP address

[jodeleeuw]

see #66 for some context.

this looks like a useful guide: https://stackoverflow.com/questions/50741936/rate-limiting-for-google-firebase-cloud-functions