Slow logins

Adds a higher cost for generating an auth token via user_auth and api_auth, to limit the impact of brute force attacks.