broken in commit d98359ab

It'd send a 429 error, but keep accepting and processing client
requests, thus not really limiting the concurrent clients (from the same
IP) ever.