Added 1s delay for login attempts. Fixed timing channel vulnerability where missing usernames and incorrect passwords were handled differently.