Give the gift of Drupal. All merchandise is 50% off through 2016.
We recently had this issue when moving a site to a live webserver, where the proxy wasn't set up yet.
When the http request in htmlpurifier_cron() fails, null gets saved into the htmlpurifier_version_current variable. This means that the current version number gets overwritten with nothing. Then when htmlpurifier_init gets called, if the user has admin rights, htmlpurifier_cron is called to try and grab the current version number on every page load, which means a delay (10s for us) on every page load.
I'll submit a patch for this when I get the chance - but it someone else wants to do it in the meantime, it's a pretty simple one (Just checking the return on drupal_http_request inside htmlpurifier_cron and maybe logging that the reqest failed should sort it).