CORS proxy: Consider updating rate-limiting to account for time spent requesting

[brandonpayton]

If the proxy is being used to make long running requests, perhaps we can account for that in rate limiting measures. This may be especially helpful if we can limit time spent in long-running requests to particular domains (this relates to #1975 which is an issue for adding per-domain rate-limiting).