fix hmac comparing timing issue