A practical guide to slowing down scanners, login abuse, and noisy clients — without locking out real users or fragile apps..