The cardinal rule of crypto: don't implement it
Make authentication take at least one second, to prevent revealing whether a username exists based on timing