Great catch! This should properly be implemented using leases:

    lease.acquire('count')
    local count = storage.count or 0
    storage.count = count + 1
    lease.release('count')
    return {count=count}

We skipped the lease just for simplicity's sake, but if you need that kind of protection, that's why we implemented leases.