Add a limitations to anonymous user for node view
If cache is enabled hook_nodeapi() is not always executed. The first time a node is viewed Drupal renders the page and save it in the cache. During this process, hook_nodeapi() will be fired. Next time the same page is viewed, Drupal will find the rendered copy in the cache,  serve this copy, and no hook_nodeapi() will be fire fired.

You have to do it in hook_boot. This hook is fired even for cached pages. You must first check if current path is a node path (you may use arg() function). Try to add lightweight code as it will be executed in every page petition.

Remember that this protection is easily bypassed clearing the cookies for your domain. 

References


hook_boot()
arg()