Comment 21 for bug 1795800

Still working on this, I've gotten a flask hook setup to catch any unauthorized, allowing us to delay the Unauthorized exception until the very end, however I'm still not seeing identical times. Local testing is showing .480 seconds for an existing user while it's gone from ~0.022 to ~0.033 for invalid users with delaying the exception.

I'm wondering if this is due to the delay with generating a token for successful authentication, instead of simply continuing on when failing to authenticate.