Refine authenticate_by security guarantee [ci-skip]

[jonathanhefner]

We are not in a position to guarantee exactly how long authenticate_by will take. For example, if the find_by query is not backed by an index, the database will need to perform a full table scan, and the query time will vary based on where the record is in the heap, if it is found at all. Therefore, we should be more specific about what we guarantee.

[consu]

in case of a failed login attemp you should avoid:

• increasing a failed attempt counter, for existing users
• create additional logging, for existing users
• load an existing user to execute additional actions, like mailings
• start displaying captachas, only if the user exists
• don't use expensive default_scope
• don't use a before action, that loads the specific user in every case
• check your after_initialize callbacks, if they
• if you increasing BCrypt::Engine.cost, you need to rehash the password, creating a new user will take more time, in this case.
• this is only tested for bcrypt, so don't override has_secure_password ...

[jonathanhefner]

Thank you for the feedback, @consu! Those are good points to keep in mind, though I think many of them fall outside the scope of authenticate_by's API documentation. Still, in the interest of managing expectations, I have removed all mention of "same amount of time" from the documentation.