Use AUTH_TIMEOUT only before authdone != 1.

While at it, fix a few indentations and typo.