Under yaegi, the authenticated cookie path allocated about 3.8 MB per
request. A yaegi harness measures bytes per request with a browser-like
cookie jar. With it, these changes cut bytes by 83%, allocations by 69%
and time by about 93%.
- Replace range loops over tokens with index loops. Under yaegi, ranging
over a string allocates O(n^2) bytes.
- Pool gzip readers for combined session cookies.
- Memoize the validated ID token within one request.
- Cache content-only token validation across requests. The key is the
token type and SHA-256, and the cache holds at most 4096 entries. The
entry keeps the parsed exp and iat claims. The expiry and freshness
checks still run on every request.
New tests pin the validator results, the memo and the cache behavior.
