Use a secure comparison in auth middleware

Otherwise you might get timing attacks:

http://verboselogging.com/2012/08/20/a-timing-attack-in-action

I don't actually know Go.  I ran through gofmt at least.

Also I feel like that SecureCompare would be generally useful in a middleware project (Rack has one in Util ,for example) so I bet it should be extracted from here.