func login(w http.ResponseWriter, r *http.Request) {
    var hashedPassword string
    var username = r.PostFormValue("username")
    var password = r.PostFormValue("password")

    if username == "" || password == "" {
        fmt.Fprint(w, "Você precisa enviar os dados")
        return
    }

    err := db.QueryRow("SELECT `senha` FROM login WHERE usuario = ? LIMIT 1", username).Scan(&hashedPassword)
    if err != nil {
        fmt.Fprint(w, "Senha ou usuário incorreto")
        return
    }

    if err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password)); err != nil {
        fmt.Fprint(w, "Senha ou usuário incorreto")
        return
    }

    fmt.Fprint(w, "Conectado com sucesso")
}

curl -d "username=QueNaoExiste&password=a" http://127.0.0.1:8888/login -w " "%{time_total}

curl -d "username=QueExiste&password=a" http://127.0.0.1:8888/login -w " "%{time_total}

curl -d "username=QueExiste&password=umasenhamuitolouca" http://127.0.0.1:8888/login -w " "%{time_total}