compare signatures without leaking timing information
Merge branch 'master' of https://eknet.org/git/eike/spray-openid