Now you have a session of sorts and can limit the requests for that client, right? They can be fast, just limited in volume - regular user isn't punished.

yep, that's the exact play. Or better fingerprinted & blocked in other ways