Moving rate limit after password check to avoid /macupdate DoS