It looks like it's limited to 10 requests per minute, it's less of a hug and more of a gentle brush past.

It's documented as "Per IP", but I'm willing to bet either that documentation is wrong, or it's picking up the IP address of the reverse proxy or whatever else is in-front of the application server, rather than the originator IP.

Why do I think that? Well these headers:

    x-powered-by Express

    x-ratelimit-limit 10

    x-ratelimit-remaining 0

Which means it's not being rate-limited by cloudflare, it's express doing the rate limiting.

And I haven't yet made 10 requests, so unless it's very bad at picking up my IP, it's picking up the cloudflare IP instead.

Probably all those cookies tipped and triggered the connection rate limiter.

I'm not following you at all?