What is the best way to implement rate limiting if our site allows payment without a login? By IP?