Make xsrf token comparison contant-time.