add timing attack protection to SimpleAuthProvider