Prevent possible timing attack on hmac comparison