OTP rate limiting