Rate limits should be per-method, not per-resource string.

config/dev/ratelimit.unauth.json

@@ -2,18 +2,18 @@
     "": 
         {"seconds": 60, "max": 30, "_comment": "Global unauthenticated ratelimit."},
 
-    "/v1/doot": 
+    "GET:/v1/doot": 
         {"seconds": 5, "max": 5, "_comment": "Unauthenticated DOOT for server monitoring."},
 
-    "/v1/login": 
+    "POST:/v1/login": 
         {"seconds": 60, "max": 3, "_comment": "Prevent bruteforce attacks on Login."},
 
-    "/v1/admin": 
+    "POST:/v1/admin": 
         {"seconds": 60, "max": 1, "_comment": "Prevent bruteforce attacks on Admin Login."},
 
-    "/v1/signup": 
+    "POST:/v1/signup": 
         {"seconds": 1800, "max": 1, "_comment": "Prevent spam account creation."},
 
-    "/v1/forgot": 
+    "POST:/v1/forgot": 
         {"seconds": 60, "max": 1, "_comment": "Slow down 'forgot password' enumeration/spam."}
 }