then you're hitting the db on every request just to do auth.
if you _had_ to do that, I would put the counter into something like redis instead.
if you _had_ to do that, I would put the counter into something like redis instead.
10 timeout to reply. o_O