improve auth failure delays to avoid indicating which users exist
merge
merge