Make CI_Session's HMAC comparison time-attack-safe