Perform CSRF token comparisions in constant time

This prevents an attacker from gaining the CSRF token through a timing
attack.