fix: reduce timing-based user enumeration

[michalsn]

Description
The OWASP Authentication Cheat Sheet recommends generic authentication errors and warns that early returns can reveal whether an account exists through response time. These changes address both discrepancies without claiming constant time for the entire request.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[datamweb]

Could you please move the existing comment:

// Extract UserToken and HMACSHA256 Signature from Authorization token
[$userToken, $signature] = $authTokens;