[darkalchemy]

So, a user could just continuously hit refresh and get enough points to buy upload credit or anything else that is available.

You should probably add a min time between updates. A simple expiring cache would do for that.