parse_cookie: Do constant time comparision of hash value.

Without this, an attacker might be able to guess the correct hash
value based on difference in response time (using many attempts).