state: refused writes limited for the node too

Review 3, R5: --refused-writes-per-minute bounds each user, but the
cost it guards, a document copy under the write lock, is the node's:
ten users, or ten accounts of one, are ten times the budget.

The node now takes six times a user's limit within a minute in all
(refused::NODE_FACTOR); past it, every user with a write refused
within the minute is answered 429 untried, until the oldest leave it.
A user none of whose writes was refused writes on, so honest writers
aren't held up by others' refusals.

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/example.toml b/docs/example.toml
index 010968a..82ba016 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -106,7 +106,8 @@ htpasswd = "/etc/continuum/htpasswd"
 # key-logins-per-user = 100
 
 # Writes a user may have refused within a minute because every node would refuse them
-# (docs/access.md); past it, its writes are answered 429 untried for a while. Each
+# (docs/access.md); past it, its writes are answered 429 untried for a while, and past
+# six times as many on the node in all, those of every user with one refused. Each
 # refusal costs a copy of the document.
 # refused-writes-per-minute = 10