== global limit 12 per minute; four users send 3 requests each
GET /api/hello  X-User-Id: u1  -> 200  limit=10 remaining=9 retry-after=null scope=user
GET /api/hello  X-User-Id: u1  -> 200  limit=10 remaining=8 retry-after=null scope=user
GET /api/hello  X-User-Id: u1  -> 200  limit=10 remaining=7 retry-after=null scope=user
GET /api/hello  X-User-Id: u2  -> 200  limit=10 remaining=9 retry-after=null scope=user
GET /api/hello  X-User-Id: u2  -> 200  limit=10 remaining=8 retry-after=null scope=user
GET /api/hello  X-User-Id: u2  -> 200  limit=10 remaining=7 retry-after=null scope=user
GET /api/hello  X-User-Id: u3  -> 200  limit=10 remaining=9 retry-after=null scope=user
GET /api/hello  X-User-Id: u3  -> 200  limit=10 remaining=8 retry-after=null scope=user
GET /api/hello  X-User-Id: u3  -> 200  limit=10 remaining=7 retry-after=null scope=user
GET /api/hello  X-User-Id: u4  -> 200  limit=10 remaining=9 retry-after=null scope=user
GET /api/hello  X-User-Id: u4  -> 200  limit=10 remaining=8 retry-after=null scope=user
GET /api/hello  X-User-Id: u4  -> 200  limit=10 remaining=7 retry-after=null scope=user
== u5 has never called before, so their own bucket is full
GET /api/hello  X-User-Id: u5  -> 429  limit=12 remaining=0 retry-after=5 scope=global
-- u5 was rejected by the global bucket, but their own bucket already paid: 9 of 10 tokens left
== five seconds later (Retry-After), u5 tries again
GET /api/hello  X-User-Id: u5  -> 200  limit=10 remaining=8 retry-after=null scope=user