Summary

When cookie.tokenkey is missing in product's crowd.properties the value will be pulled from Crowd's /rest/config/cookie endpoint every time authentication check happens.

cookie.tokenkey is an optional configuration and it should be safe to not define it, but at the same time it adds a lot of unnecessery communication load. Making it cached on server side for few minutes could address this problem.

Workaround

Set the cookie.tokenkey to the value configured in the Crowd server. This is detailed in The crowd.properties file. Specifically:
An example of this configuration:

...
cookie.tokenkey=crowd.token_key