Make automated abuse expensive.

Every attempt costs the caller real work before your server sees it. The token it produces spends once, on one action, from your own hostnames.

• Proof of work on every attempt
• Single-use tokens, bound to one action
• Escalation that remembers repeat offenders