We should support rate limit base on IP or/and token. Shuold have a way to specific number of request per duration.