Harden password comparison vs. timing attacks

The ruby string comparer shouldn't be trusted not to short-circuit the string compare, which may create a vulnerability to timing attacks.