actually use the constant-time compare function in secure_loads
never use secret key as an initialization vector
Merge pull request #58 from mwielgoszewski/master

Cryptographic vulnerabilities: Key as IV, insecure HMAC comparison