Allow specifying a connection timeout

[fluffy-critter]

Most auth methods involve making an additional HTTP connection back to an external server, and this connection has the potential to time out. It's pretty easy for someone to DoS (accidentally or otherwise) a site by sending login requests that go to an external HTTP server that never responds.