make timeIndependentHmacCompare actually time independent

This is addressing laterpay/laterpay-wordpress-plugin#148

@mturalenka ready for review
and perhaps we shouldn't... because a zero-length input is not the same as the strings not being equal, it should never happen when we compare HMACs. Falling over and dieing might be the exact right approach.