Here are a few resources about timing attacks:

 * [Exploiting Remote Timing Attacks](http://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/)
 * [Timing Independent Array Comparison](http://rdist.root.org/2010/01/07/timing-independent-array-comparison/)
 * [SSL Timing Attacks](http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf)
 * [Nanosecond Scale Timing Attacks On PHP Applications](http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote-timing-attacks-on-php-applications-time-to-take-them-seriously/)

It's a very real thing. With shared hosting, where an attacker can get code literally on the same box that the application is running on, timing differences of a single character of an == comparison are definitely possible (using statistical techniques at least).

So while it may not be strictly necessary in this case, it's definitely not bad to do.