API rate limiter blocks legitimate requests