One conditional UPDATE writes it at most once per five minutes per user. A failed write is logged and never fails authentication, and no user payload carries the column.
