Fix off-by-one issue

After close analysis, protection is still effective, but this pull still make MAX_REQUESTS_PER_MINUTE do what it should do.