1. I assume you're paraphrasing the details because JavaScript doesn't have a `sleep`, do you mean there were setTimeout loops or something?

2. Other than a job security sandbag, I wouldn't be surprised if this was an an even sloppier solution to a sloppy race condition where session token wasn't reliably cached across a distributed system or something. Gross either way.