Rate limiting abusive clients with Rack::Attack

                  class Rack::Attack
  throttle('logins/ip', limit: 5, period: 20.seconds) do |request|
    request.ip if request.path == '/users/sign_in' && request.post?
  end

  throttle('password_reset/email', limit: 3, period: 15.minutes) do |request|
    if request.path == '/password_resets' && request.post?
      request.params['email'].to_s.downcase.strip
    end
  end

  self.throttled_responder = lambda do |_env|
    [429, { 'Content-Type' => 'application/json' }, [{ error: 'rate_limited' }.to_json]]
  end
end