How do you prevent abuse and limit the call rate if you don't require an API key? Even with IP-based limits, I could programmatically pipe my calls through Tor.