webaccess: Always sleep for 1s before returning HTTP 401

Not all authentication plugins require the Authorization header, so it
might not be present in subsequent attempts. (In particular, a reverse
proxy might strip it.)

src/node/hooks/express/webaccess.js

@@ -35,17 +35,12 @@ exports.checkAccess = (req, res, next) => {
   const failure = () => {
     return hooks.aCallFirst('authFailure', {req, res, next}, hookResultMangle((ok) => {
       if (ok) return;
-      /* No plugin handler for invalid auth. Return Auth required
+      // No plugin handled the authn/authz failure. Fall back to basic authentication.
-       * Headers, delayed for 1 second, if authentication failed
-       * before. */
       res.header('WWW-Authenticate', 'Basic realm="Protected Area"');
-      if (req.headers.authorization) {
+      // Delay the error response for 1s to slow down brute force attacks.
-        setTimeout(() => {
+      setTimeout(() => {
-          res.status(401).send('Authentication required');
+        res.status(401).send('Authentication Required');
-        }, 1000);
+      }, 1000);
-      } else {
-        res.status(401).send('Authentication required');
-      }
     }));
   };