adding random delay to prevent timing attacks on user auth