title: Node.js rate limiter auth token instead of IP address
body: <p>ive been exploring rate limiting for my mobile app express node.js API. What ive found so far is this solution with express-rate-limit and rate-limit-redis:</p>
  
  <pre><code>&gt; app.use('/account/reset-password', rateLimit({ store: (new
  &gt; RedisStore({ //configs here })),   windowMs: 5 * 60000,   max: 12,
  &gt; delayMS: 0
  &gt; 
  &gt; }));
  </code></pre>
  
  <p>its clean, its nice, it probably works straightfoward, BUT it is not want I want. I want to rate limit my API calls by auth token, not IP address. What would be the simplest way to do this? Im REALLY not trying to write my own solution from scratch this time (Unless thats the ONLY good option), before today I had not even heard of redis etc.. </p>
  
  <p>Thanks in advance guys, I hope theres a pretty straight foward answer for this.</p>
  
  <p>Sorry for bad formatting, on iOS.</p>