Use length-independent string compare for password check

Thanks to Jann Horn for pointing this out.