Don't use md5, use constant time string comparison.

Fixes possible security vulnerabilities.