Fix timing attack

Makes HMAC comparison to avoid potential timing attacks.