usage limit per user on public deployment

if https://github.com/antifield/vmt/issues/6 is added, it's probably best to limit usage per day or rolling widnow per user for our public deployment (allow it to be turned off for self-hosted cases) + configurable via `.env` i guess?