Just set a half-second timer, run bcrypt (or don't), and then respond when the timer goes off.