Per-session rate limits on requests