[zie]

yes, get more CPU's if your auth server is hitting it's limits.

Scale it by moving auth to it's own URL, so you can then load-balance it differently if needed (and can add more security like disallowing Javascript at all - via headers, etc)

But first, verify you are actually hitting CPU max because of bcrypt/scrypt/etc and not just because of crappy code or something.