Quick question on that 1 request per second thing. Say we have 500 users using the site at once. Now let’s say 50 of them login at once. That is going to pull their username, info and such. Isn’t just authing them going to go over the limit?
(They are logging into the site and holding the session using Twitch. On each page call it checks using an encrypted version of their key stored in the cookie to make sure the Twitch account is still good and matches some user information to make sure the session is valid. The only way to ensure that the userid in the cookie is the actual user, is to un-encrypt the access key in the cookie with a public key, and a private key + salt connected to that user by pushing it through the Twitch API. This means each page call will be a ping at Twtich.)