The current contract is that if you call allowed and it returns true, increment will never throw an exception.

I think removing the call to ensure opens up a possible concurrency issue; if we every give up the main thread after calling allowed and before calling increment.