== two limits: 3 per second AND 10 per minute (both must have a token)
second 0: 5 attempts, 3 allowed, running total 3
second 1: 5 attempts, 3 allowed, running total 6
second 2: 5 attempts, 3 allowed, running total 9
second 3: 5 attempts, 1 allowed, running total 10
second 4: 5 attempts, 0 allowed, running total 10