Yikes - Scrypt was doing a non-constant time comparison