constant time hash comparision

Without this, an attacker might be able to guess the correct hash
value based on difference in response time (using many attempts).

This might be important, or it might not. I just saw it when browsing through the code so the HMAC of the cookie might not be used in a security critical manner at all.

Note: untested, I do not have a suitable test environment.

/Fredrik