Prevent address exhaustion attack

[bartekn]

This is theoretical attack but should be discussed and at least mentioned in a README file.

BIP-32 allows generating up to 2,147,483,648 - 1 addresses using a single public master key. In theory, someone could send lots of requests and generates lots of unused addresses.

RPS	Exhausted in
100	248 days
1000	24 days
10000	59 hours

Possible solutions:

• Use m / purpose' / coin_type' derivation path and generate a new account when address_index level becomes exhausted.
• Rate limiting (implemented in bifrost?)
• Captcha (implemented in bifrost?)

[howardtw]

Closing because it's bifrost related