Agree with Mateusz, now he's pointed it out: SolrIndex isn't a controller, it's a model. Rate limiting should be in the search form handler.