RateLimit for users.setStatus even if disabled (globally or privilege)

Description:

Hi Rocket.Chat Team,
i'm calling "users.setStatus" with a separate user, lets call him "API" user, to set a status and a custom message to sync states between others systems with the rocket.chat status. This works quite well but i'm getting "please slow down" messages as response when i make some "more frequent" requests.
the user which calls the function has the admin privilege and the priv to "bypass" rate limiting and i have disabled it completely in the administration with no luck: rocket.chat always tells me after a few requests that i have to slow down.

a litte side note: when the limit is reached the user whos status was set via my API call cannot change his status via the client, it seems like the rate limit counts globally and not per user.

Steps to reproduce:

1. grant "bypass rate limit" permission or disable rate limit globally (or both)
2. call REST API users.setStatus with status und custom message ("online", "some text") for about 10 times within 10 seconds

Expected behavior:

• slow down messages for the "API" user is disabled so should not be returned
• in addition, the user can change his status independent of what "setStatus" were issued for him by another "API" user

Actual behavior:

"please slow down" message is returned by the API, the target user of the users.setStatus call cannot change his status via client until the limit is reset.

Server Setup Information:

• Version of Rocket.Chat Server: 3.9.7
• Operating System: Linux 4.9.0-14-amd64
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.20.1
• MongoDB Version: 4.0.22

Client Setup Information

• Desktop App or Browser Version: 3.1.1
• Operating System: Windows 10

Additional context

no further information

Relevant logs:

no relevant log entries

Start by reproducing the REST API users.setStatus calls described in the issue with rate limiting disabled and with the bypass permission. Trace how rate limits are applied to that entry point and how the target user's status changes are handled; done means the API user is not limited when exempted and the target user can still change status independently.