Use constant-time comparison for credentials

Taking cue from martini's [auth](https://github.com/martini-contrib/auth), use constant-time comparison to prevent timing attacks.