[comboy]

Maybe evening response time is some abstraction on top? It may be useful for protecting much more than just auth so it would make sense not to repeat that on every layer.

[dvdkon]

I considered that, but it seems way too fragile to trust, expecially if you want to test complex relationships for authorization.