Fixes two timing attack vulnerabilities

Fixes two timing attack vulnerabilities that occurred when:

- comparing password hashes
- comparing CSRF token hashes

The solution employed here is to use the "scmp" NPM module that does char-per-char string comparisons in a constant time.