Use a constant time comparison in the API auth
Merge pull request #1235 from alex/patch-7

Use a constant time comparison in the API auth