Comment by nbpoole

Not quite. Your rate limiting seems to be cookie based, which makes it easy for someone to circumvent just by replaying their initial request (or by deleting the cookie you set).