Use PasswordUtil::secureCompare() to validate SECURITY_TOKEN