Use constant_time_compare to check oauth2 secrets.