To stop people attempting to login lots of times/fill in contact form lots of times/keep submitting search queries etc. is it normal/recommended to use a session variable or to write the ip address to a database?