Avoid possible timing attack in hash comparison (closes #3243)