I believe 1000 was what the Pi was already at in the Nalanda deployments, for student accounts, and they said it was taking the classes 15 minutes to log in, so 500 (for the local cache) seems safer. This is only used on Pi deployments, which I figured could all benefit from the boost, but I suppose some Pi deployments may not have so many students. But since this is just for the local cache, and anybody with access to the local database could probably also put in a sniffer to catch the local passwords in plaintext, I don't think we're sacrificing too much here in terms of security.