So, most important query will be "challenged" too (see #87)

We can handle challenge request at Kernel level to improve performance.
For example pre-generate 10k random challenges, choose any for each request and pass requests only when client send request with our challenges

Why 10k? It's big enough and we do not need spent time to generate challenge number.
And when DDoS happend we do not need generate and store unused challenges (in common we need generate and remember challenge number, or use asymmetric alorithm and generate/validate on fly) it's too complex to handle it properly.