[WIP] Login rate limit: no-cache implementation

Currently login rate limiting is limited to installs with caching. This
tries to fix that.

WIP because I need feedback on how to implement IP rate limiting without
being too DB-expensive.