600 per minute per token, in the Redis that sessions already require. Cookie sessions are untouched. A Redis failure falls through rather than refusing traffic — it is already a larger problem and should not become a second outage.
mrhid6
3b4c87a292