Reading your post, it's amazing the checkboxes of failed access control efforts: * trying to control clients * obfuscating IDs * rate limiting data ...rathe

Reading your post, it's amazing the checkboxes of failed access control efforts: * trying to control clients * obfuscating IDs * rate limiting data ...rather than the more boring yet standard approach of thinking through an access control policy and then enforcing that at the server.