Do constant time string comparision to mitigate side channel attacks

@peterbe @lonnen whachu think? more TODOs down!