Prevent timing side channel attack.

As per #16 not only is '==' lazy and short circuits, but so is `all?` and `any?`
so the previous fix won't work for padded attacks (where the string length is
padding during a brute force). This refactoring uses inject which will always
iterate over all the characters.

See https://gist.github.com/JonRowe/6437213

/ht @samphippen for the check