Clarified that constant_time_compare doesn't protect string lengths.