Summary.

Full review comments:

- [P1] Token check is not constant time {REPO}/src/auth.py:3-5
  Body.

- [P2] Retry counter can go negative {REPO}/src/auth.py:10-12
  Body.
