Yes, but without these rules, there would be people spamming everyone uncontrollably and wasting resources. Anything with this level of users needs these kinds of rules in place or he service eventually becomes useless.

The oath tokens are there because too many developers don't seem to understand good security practices when storing usernames and passwords