If you increase bcrypt's workfactor then legitimate requests take longer.