Request throttling

[itsrachelfish]

We should only expect requests every 100ms per session. If we receive an abnormal number of requests in a single session like a request every 10 or 20ms (bots attempting to brute force), their session should automatically fail.

We don't want the threshold to be set too high in case of false positives, like if somebody has two tabs with the captcha open. But we definitely want to prevent brute force