Use a constant time comparison in the API auth