Place throttles close to the code they are protecting

[eliotsykes]

Prefer placing throttles nearer to your vulnerable code, as they are less likely to be bypassed due to developer forgetfulness.

For example:

1. Developer protects all API v1 endpoints authentication from brute force attacks with a throttle in your rack attack initializer.
2. Developer introduces API v2 endpoints that use the same authentication code (User.authenticate) as API v1, but forgets to add a corresponding throttle to the rack attack initializer for the new endpoints.
3. API v2 is vulnerable to brute force attacks.

If the throttle had instead been placed in User.authenticate, then API v2 would have been protected from brute force attacks and developer forgetfulness.

Relevant discussion and ideas for using rack attack throttles outside of the initializer: rubygems/rubygems.org#2088 (comment)