Your users aren't IP addresses.

Let’s get this out of the way first: I’m not saying IP-based rate limiting is bad. Sometimes it’s the only thing you can. But if you’re still defaulting to IPs every time without thinking twice, you’re doing your users and yourself a disservice. Ther...