An API route with no rate limiting works fine right up until someone hits it a thousand times a second, either by accident a buggy client retry loop or on purpose. I learned this the annoying way, watching a client's database bill spike because a pub...