Actual rate limiting costs nothing.

The login gate is intentionally a login gate.