Fixes #91 Use constant time HMAC comparisons to avoid timing attacks