Rate limit key: ip limits per client IP, userId limits per authenticated user.
ip
userId
final String key;