Implement request limiter based on IP or someother identification of the user for 3rd party APIs.

[mplekunov]

[nashirj]

Can maybe use the users JWT if IP is too challenging

[mplekunov]

We can't because we allow searching for all users. So the endpoints that actually do use 3rd party API are available for both authorized and unauthorized users