Test ratelimiting without session