[Security] Use hash_equals for constant-time string comparison