Visiting the page: http://stackauth.com/1.1/sites
yields the following headers:
Notably absent are the X-RateLimit-Max
and X-RateLimit-Current
headers that show up in API queries to the sites themselves.
For the time being, as everything on Stack Auth is "query when needed (which is rarely), cache for a day", the inclusion of rate limit headers is kind of pointless.
Basically, if you ever need to check that you aren't hitting your quota... you're probably doing something wrong. There are naturally exceptions, but still in 99% of all cases the headers are pointless.
If Stack Auth ever grows methods that merit more aggressive calling, it'll gain some indication of rate limiting.