If you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable