I aimed for 10-20/sec in dev on my macbook, but I have been doing everything on appengine recently, and haven't been getting consistant results on the live environment. It varies a lot in profiling - and I am thinking of slowing it down further since I have long-lived sessions on by default (set to a year) so password checks are rare

I made the session tokens crazy long though, and have one for the user session and another for auth, and a sanity check within the auth token that will add any IP that attempts to forge the session token added to the ddos blacklist after 3 attempts. The auth token generation is slow as well - which is something that is often overlooked in webapps. I got a bit carried away in implementing all of it - but it was fun