That definitely explains the behavior I was seeing. But to me, any way to bypass the rate limiter seems like a security hole. Is there any way to change the phase/order of these two directives, or to otherwise cause rewritten requests to be rate limited?