By default django-ratelimit will limit based on ip. ip=False disables that default, and only uses user_or_ip.