Bypassing GraphQL brute force protections