How the token bucket algorithm absorbs bursts while still holding a long-run average, and what that looks like in a few lines of JavaScript