Ease some caps and limits for privileged authed (OpenUserJS#1913)

* Mod's need more access *(less cap limiting)* and of course Admin+.
* Rate limiting is in effect for Mods in case their device or network is compromised. May consider a "pardon" like with scoring when that time comes.

Applies to OpenUserJS#944

NOTE:
* This is a WIP. Ton of things to test and (re)consider. Patience is a virtue. ;) :)

Auto-merge

routes.js

@@ -51,6 +51,14 @@ var installCapLimiter = rateLimit({
   handler: function (aReq, aRes, aNext, aOptions) {
     aRes.header('Retry-After', waitInstallCapMin * 60 + 60);
     aRes.status(429).send();
+  },
+  skip: function (aReq, aRes) {
+    var authedUser = aReq.session.user;
+
+    if (authedUser && authedUser.isMod) {
+      this.store.resetKey(this.keyGenerator);
+      return true;
+    }
   }
 });
 
@@ -84,10 +92,17 @@ var installRateLimiter = rateLimit({
   keyGenerator: function (aReq, aRes, aNext) {
     return aReq.ip + aReq._parsedUrl.pathname;
   },
-  skip: function (aReq, aRes, aNext) {
+  skip: function (aReq, aRes) {
+    var authedUser = aReq.session.user;
+
     if (aReq.params.type === 'libs') {
       return true;
     }
+
+    if (authedUser && authedUser.isAdmin) {
+      this.store.resetKey(this.keyGenerator);
+      return true;
+    }
   }
 });
 
@@ -104,6 +119,14 @@ var apiCapLimiter = rateLimit({
   handler: function (aReq, aRes, aNext, aOptions) {
     aRes.header('Retry-After', waitApiCapMin * 60 + 60);
     aRes.status(429).send();
+  },
+  skip: function (aReq, aRes) {
+    var authedUser = aReq.session.user;
+
+    if (authedUser && authedUser.isMod) {
+      this.store.resetKey(this.keyGenerator);
+      return true;
+    }
   }
 });
 
@@ -146,6 +169,14 @@ var captchaCapLimiter = rateLimit({
         width: 350
       }))
     );
+  },
+  skip: function (aReq, aRes) {
+    var authedUser = aReq.session.user;
+
+    if (authedUser && authedUser.isMod) {
+      this.store.resetKey(this.keyGenerator);
+      return true;
+    }
   }
 });
 
@@ -204,6 +235,14 @@ var listCapLimiter = rateLimit({
         aRes.connection.destroy();
       });
     }
+  },
+  skip: function (aReq, aRes) {
+    var authedUser = aReq.session.user;
+
+    if (authedUser && authedUser.isMod) {
+      this.store.resetKey(this.keyGenerator);
+      return true;
+    }
   }
 });