rate-limiting update, now using a compound sliding-window. Continuing to move over to using traits more, and other code cleanup.

docs/env.example

@@ -11,14 +11,11 @@
 # NOTE: rate limiting can *NOT* be disabled,
 # but you could allow hundreds of logins a second
 
-# number of consecutive failed login attempts before we block the ip address
-#LIMIT=4                    # default 4 failed login attempts before blocking
-
-# time between failed login attempts that are consecutive, in seconds, zero for DEFAULT
-#LIMIT_TIMEOUT=21600        # default 6 hours
-
-# how long a blocked ip address stay blocks, in seconds, zero for DEFAULT
-#LIMIT_TTL=86400            # default 24 hours
+# rate limiting, default is the lower of 2 per 30 seconds or 10 per hour
+#BURST_COUNT=2   # 2 per 30 seconds
+#BURST_TIME=30   # seconds
+#UPPER_COUNT=10  # 10 per hour
+#UPPER_TIME=3600 # seconds (1 hour)
 
 # --- Extra Options ---