Preserve login failure timing attack protection despite our screwy UserPassword model and auth setup