how to test rate limiting api