update hmac signature comparison

see https://docs.python.org/2/library/hmac.html#hmac.compare_digest

pinging @rgbkrk

- [x] leave a comment in the source code about why we do this