Decouple SGU authentication from profile pages

docs/security.md

@@ -24,9 +24,9 @@
 - Client private keys are non-exportable and reside in `LocalMachine\My`.
 - The NTLM validator rejects non-HTTPS redirects, URI user information, and hosts
   outside its explicit redirect allow-list.
-- Profile enrichment reads only allow-listed HTTPS pages and caps the response
-  body at 512 KiB by default. Portal cookies are request-scoped and held only in
-  memory.
+- Authentication and profile enrichment read only allow-listed HTTPS pages.
+  Profile bodies are capped at 512 KiB by default; portal cookies are
+  request-scoped and held only in memory.
 
 ## Profile minimization
 
@@ -43,6 +43,9 @@
   before metadata is synchronized.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.
+- Slow profile pages cannot change an accepted credential into a rejection. The
+  lightweight NTLM root is authoritative; enrichment has its own shorter total
+  timeout.
 
 Lab self-signed certificates are appropriate only for the isolated VM network.
 Use an enterprise CA with revocation checking in production.