What about timing attacks?

[petterreinholdtsen]

I see code in authenticate() function on this form:

  if (something)
     raise FAILED
 if (something_else)
    raise FAILED

This might make it possible to time where in the process the error was detected. Is it perhaps better to do something like this:

if (something)
   error = True
if (something_else)
  error = True
if (error)
  raise FAILURE

Or is it not needed for other reasons related to for example django?