FIX: Delete the invalid auth cookie even if you hit the rate limit

lib/auth/default_current_user_provider.rb

@@ -48,7 +48,7 @@ class Auth::DefaultCurrentUserProvider
     if auth_token && auth_token.length == 32
       limiter = RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN , 60)
 
-      if request.ip == "127.0.0.1" || request.ip == "::1" || limiter.can_perform?
+      if limiter.can_perform?
         @user_token = UserAuthToken.lookup(auth_token,
                                            seen: true,
                                            user_agent: @env['HTTP_USER_AGENT'],
@@ -62,7 +62,11 @@ class Auth::DefaultCurrentUserProvider
         begin
           limiter.performed!
         rescue RateLimiter::LimitExceeded
-          raise Discourse::InvalidAccess
+          raise Discourse::InvalidAccess.new(
+            'Invalid Access',
+            nil,
+            delete_cookie: TOKEN_COOKIE
+          )
         end
       end
     end