There was a good talk I would recommend watching by Jeremy Edberg (Architect from Netflix/Eeddit that said to put limits on everything)
http://www.heavybit.com/library/video/2013-08-13-jeremy-edbe...
"As I mentioned before, you need to watch your limits. You should also put limits on everything. Put a hard number of limit on number of API requests that could be made from any one IP. Make it a thousand a second, something absurdly high. Because you know what? One day, that's going to happen and you're going to be really glad that that limit was there because now you've blocked somebody from completely taking down your service, maybe because they just wrote a bad robot or something, you know? They were trying to scrape your site, they screwed up, they're hitting you 10,000 times a second. At least, it won't take you down. Or, maybe perhaps, you've been linked from the Yahoo front page, which is what took down Reddit the first time when somebody put a Reddit button on a page that was linked from the Yahoo! home page. We basically DDoS-ed ourselves with the Reddit buttons. We quickly figured out how to put that on a CDN, so we didn't have to deal with that problem anymore."