Securely compare API keys

This fixes a [timing attack](https://en.wikipedia.org/wiki/Timing_attack) vulnerability as the API keys are being compared.  Credit goes to @mastahyeti for discovering this problem and suggesting the solution.

/cc @johndbritton