I wrote:

>
> A half baked solution would be an API that simply kills all requests
> associated with the client's address, but this is not going to
> work with NAT
> or local connections or worse, with web clients.

And I forgot to say that IP addresses aren't reliable since you can spoof
them with raw sockets, so a token that's hard to guess seems the best
alternative.

C.