limit_req seems to have no effect, but I would prefer it did

[zildjohn01]

That definitely explains the behavior I was seeing. But to me, any way to
bypass the rate limiter seems like a security hole. Is there any way to
change the phase/order of these two directives, or to otherwise cause
rewritten requests to be rate limited?

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,231530,231611#msg-231611