Investigation: Check and potentially fix timing attack vulnerability in pwreset

[andrewtavis]

Terms

• I have searched open and closed issues
• I agree to follow activist's Code of Conduct

Issue

Based on discussion in the work for #1864, we want to actually test the timing of the pwreset method to see what the difference is when a user does and does not exist. Ideally these would be very similar, and if the non-existing user is leading to a consistently lower response time, then we'd make changes to backend/authentication/views.py to fix this :)

[andrewtavis]

CC @to-sta for the work here 👋 Looking forward to seeing what comes from this 😊