Add timing safe comparison of known loginToken and cookie supplied loginToken