cap the maximum time that preauth takes in any case