Brute force protection allows to send more requests than intended