Add Rate Limiting to the API

You've inherited a small, already-running JSON API service. It works, but it has no protection against a single client hammering it. Your job is to add rate limiting by capping the number of requests a client can make in a certain window, without disturbing the endpoints that already work.