Fix rate limiting

[ayush-goyal]

The rate limiting currently works by rate limiting by ip address. However, during events since everyone is on the same wifi, it basically blocks everyone during critical moments (like registration or judging) since all the requests come from the same ip address. Fix this by doing rate limiting by user, and if they're not logged in, then rate limit by ip address.

Try to put this rate limiting as far up in the middleware as possible so that we don't waste resources for requests that should be rate limit blocked.