Use constant time compare to be precautious about HMAC timing attacks