If your service is public facing and therefore subject to DoS attacks, you should design around the error path being fast.

Which really should be possible with exceptions. It's a shame that it isn't.