small defense against timing attacks on login