Use a secure comparison for secret strings

Change-Id: Ie995d7c36dfbe04f52b7ee8b43f1e0ac9d17e369