another fix for human choices

server/src/app.ts

@@ -57,7 +57,7 @@ app.use('*', secureHeaders({
     scriptSrc: ["'self'", 'blob:'],
     styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
     imgSrc: ["'self'", 'data:', 'blob:'],
-    connectSrc: ["'self'", 'https://huggingface.co', 'https://*.huggingface.co'],
+    connectSrc: ["'self'", 'https://huggingface.co', 'https://*.huggingface.co', 'https://*.hf.co'],
     fontSrc: ["'self'", 'https://fonts.gstatic.com'],
     workerSrc: ["'self'", 'blob:'],
   } : undefined,
@@ -67,7 +67,7 @@ app.use('*', secureHeaders({
 app.use('/api/*', bodyLimit({ maxSize: 256 * 1024 }))
 
 // Global rate limit (120/min per IP — generous for polling + signup flows)
-app.use('/api/*', rateLimit(60_000, 120))
+app.use('/api/*', rateLimit(60_000, 300))
 
 // API cache headers
 app.use('/api/*', async (c, next) => {