title: prevent brute force attack by blocking IP address
body: <p>Im building a site where users enter promo codes. There is no user authentication, but i want to prevent someone entering promo codes by brute force. I'm not allowed to use captcha, so was thinking of using an IP address blocking process.  The site would block a user's IP address for X amount of time if they had X failed attempts at entering the promo code. </p>
  
  <p>Is there any glaring issues in implementing something like this?</p>