Replace _constant_time_compare with werkzeug's safe_str_cmp

Werkzeug's [werkzeug.security.safe_str_cmp](http://werkzeug.pocoo.org/docs/utils/#werkzeug.security.safe_str_cmp)  function already implements a constant-time string comparison (see it [here](https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/security.py#L108)) which is probably worth using rather than creating a new implementation in flask-login.