Prevent timing attacks on passwords

Use a constant time string comparison.