use time-constant compare for csrf token
Merge pull request #4 from freewil/scmp

use time-constant compare for csrf token