I think we can rule out the json serializer. I just replaced the code in tools.py and serializers.py and tried this. I also confirmed that the C json library was installed. There wasn't any change. However, I wonder if I should send those changes to Massimo as a patch anyways since it seems like we should prefer the C libraries when possible.
As for your other question, simply having "auth = Auth(db)" in there without defining the tables seems to slow down XML by a few ms, but we are talking 5ms at most. The define_tables call is what slows it down the other 20 ms. However, it may not be Auth at all. I just defined a dummy table just to see what would happen, and the XML times went back up to 50 ms, so it looks like the DAL is somehow causing the slowdown. And I just run a second test on the dummy table with "migrate=False" and the numbers dropped back down to 20ms. So it looks like we've narrowed down the problem to migrations.
