Add throttling, debouncing and rate limiting

[092vk]

1. Without captcha and throttling, the api calls can be overwhelmed
2. Add rate limiting to avoid spamming