API routes which mimic external APIs - things like NuGet, our Go proxy,
and our Terraform API - often allow a personal access token to be passed
in basic auth.

We weren't handling that case in Rack Attack, which meant those requests
were being handled by the unauthenticated throttle even when they were
authenticated.