Use a secure comparison in auth middleware

Otherwise you might get timing attacks:

http://verboselogging.com/2012/08/20/a-timing-attack-in-action
Merge pull request #31 from bemurphy/secure_compare

Use a secure comparison in auth middleware