The web service should talk to the rate-limit server and deny requests if the rate limit server says a request should be denied. Take a look at the old Mason web service (cgi-bin/MusicBrainz/Handlers/WS/1/Artist.pm for an example on how to call the rate-limiter.