auth: limit delay to plugin.timeout

(so Haraka doesn't crash when the delay is set > plugin.timeout