Add rate limiting for import

**Feature request**
It would be great to have filtering for auth.

**Use case**
Many users need this functionality for production deployments.

**Implementation idea**
Add a new config option `enable_filtering` with default `false`.

No files, tests, or entry points are named. Start by locating the import and authentication configuration entry points, then clarify whether the requested behavior is rate limiting or auth filtering; done should include a confirmed configuration default and tests for the intended behavior.

Written by the indexing model from the issue text.