Constant time check to avoid timing attacks

Timing attacks use the time it takes to return the result of hash
comparisons to figure out a good input for the password. This fix adds a
function that compares until it's done looking at the entire hash
instead of as soon as it finds a difference.

Fixes issue #3