fixing probable timing attack

A potential timing attack was reported and has been fixed in this patch.
Previously we were comparing the decoded cookie to a potential match but in
such a way that the time taken might depend on the size of the input. This
introduces a vector for a timing attack.

Here we fix this by ensuring we use a method for constant time comparison,
mitigating the feasibility of a timing attack.