update hmac signature comparison

see https://docs.python.org/2/library/hmac.html#hmac.compare_digest

pinging @rgbkrk
We're declaring here that since they're on an old version of Python, they need to upgrade but we let it work for now.

Should we display a warning message?