Use timing safe string comparison in CSRF filter

Use a timing safe comparison, as provided by the Symfony Security Component.

As proposed by by @lasselehtinen and @ircmaxell in https://github.com/laravel/laravel/commit/ba0cf2a1c9280e99d39aad5d4d686d554941eea1

(I'm not a security expert, so they more knowledge about this)
Fixed both issues