Consegui encontrar uma resposta que aparentemente é por design: o desafio de autenticação é estar em todas as solicitações. Um trabalho que eu implementei é permitir listagem anônima de diretórios / arquivos (solicitações PROPFIND) e autenticação em todo o resto usando a configuração do Apache mostrada abaixo. A melhoria de velocidade é significativa, para um projeto python com 21876 arquivos, uma atualização leva metade do tempo, 11 minutos contra 22 minutos com autenticação.
## Development HTTP Site
<VirtualHost *:80>
ServerAdmin [email protected]
ServerName development.FOO.com
ServerAlias www.development.FOO.com
# Log file location and settings; logs within project is ok as long as 'links' are made to system 'var/log/apache'
ErrorLog /var/log/apache2/development.FOO.com-error.log
CustomLog /var/log/apache2/development.FOO.com-vhost_combined-access.log vhost_combined
# Canonical to always strip www - see: https://stackoverflow.com/questions/88011/make-apache-automatically-strip-off-the-www
RewriteCond %{HTTP_HOST} ^www\.(.+)$
RewriteRule ^(.*)$ ${SERVER_PROTOCOL}://%1/$1 [R=301,L,NC]
# Authenticated access for the development site version - because without this Google will find you!
# Just in case we also prevent serving of the password logins file if it is stored in a serving folder.
Redirect /apache-logins.htdigest http://development.FOO.com
<Location />
DAV On
DirectoryIndex disabled
Options +Indexes
AuthType Digest
AuthName "development.FOO.com"
# AuthDigestDomain which urls (and any under it) this applies - should match location
AuthDigestDomain /
AuthDigestProvider file
AuthUserFile /srv/www/django/development.FOO.com/apache-logins.htdigest
# uncomment the LimitExcept to receive a small boost for non caching Windows WebDav client by allowing
# anonymous directory listing; see http://serverfault.com/questions/250578/webdav-and-windows-7-client
<LimitExcept PROPFIND>
Require valid-user
</LimitExcept>
</Location>
WSGIProcessGroup development.FOO.com
# You can further limit processes, threads and set a inactivity-timer so deamon get unloaded
WSGIDaemonProcess development.FOO.com display-name=%{GROUP}
WSGIScriptAlias / /srv/www/django/development.FOO.com/apache-django-development.wsgi
# Serve static / media files through apache instance and alias/map them to specific urls. to maximize security
# 'Options -Indexes' is enabled to prevent directory listing
Options -Indexes
Alias /robots.txt /srv/www/django/development.FOO.com/src/django-project/static/robots.txt
#Alias /sitemap.xml /srv/www/django/development.FOO.com/src/django-project/static/sitemap.xml
Alias /favicon.ico /srv/www/django/development.FOO.com/src/django-project/static/favicon.ico
Alias /media /srv/www/django/development.FOO.com/src/django-project/static/
Alias /static /srv/www/django/development.FOO.com/src/django-project/static/
</VirtualHost>
Aqui estão mais algumas informações: link