I guess it doesn't really make any difference in this case, but we should get used to comparing hmacs in constant time, everywhere.