take care about both limits: user, ip