the remaining 200 requests that I suspect are bots are very low volume, though, so I'm mostly happy for now. also added a /robots.txt in case that helps any polite bots not send requests in the first place.