using werkzeug.security for constant-time compare
version 0.1.18