"F5 storms" are easy to handle. Intercept all keypress combinations for refresh and do what you want with it client side. (spread it out over time, use a high-performance endpoint to check if live or a combination)
Most people doesn't use the refresh button in the browser, so only a small amount of traffic will be uncontrolled.