Check quota enforcement /before/ initiating database query.

[pgulley]

Right now our query quota implementation doesn't bail out of a request until /after/ the potentially costly database operation has been completed! So, although we return 404s when the quota is reached, we don't actually save ourselves any work.

A quick fix would be to just move the increment call up the function to before the request to db is made. A less quick, but more robust fix would be to move the quota logic to a request middleware and manage this all at the same step is other authentication concerns.

[pgulley]

#856 fixes