Thanks. The answer is very clear. It means if I had to enable Token theft detection feature, each subsequent request that requires SuperTokens middleware validation, a database call is to be made? Am I correct?