Locally cache device ID lookups

[kegsay]

If a user with a bad access token comes along and hits the API, we see some logs like this:

11:07:53 WRN failed to get user ID from device ID error="/whoami returned HTTP 401" device_id=20d...

This isn't great as it is a 1:1 relationship between requests to us and requests to the upstream HS, making it a spam vector. Let's cache the lookup in a LRU cache for a bit. It also spams logs.