Comment by holtalanm

then you're hitting the db on every request just to do auth.

if you _had_ to do that, I would put the counter into something like redis instead.