Congestion control is required to be enforced at the browser level as an anti-DoS measure. You could just have the browser API limited to 15kbps, but that seems like a silly limitation when the way around it has already been implemented...