Make server wait a random amount of time when username is bad to mimic password being bad

[cgm616]

When logging in, if the username is not in the database the response will come back almost immediately, because the database call takes relatively less time than hashing a password to see if it is correct. Therefore, an attacker can mine our database for usernames by testing to see what combinations of login usernames go fast compared to waiting for hashing.

To prevent this, the server should wait a random-but-plausable amount of time after deciding that a username is bad before sending a response.

[cgm616]

This might rely on asynchronous Rocket, because otherwise it will stall our entire server on the wait... Check out rwf2/Rocket#17.

[cgm616]

For prod, probably some sort of nginx reverse proxy can be used to circumvent this: check out rwf2/Rocket#243.