Jetty-Util credential timing

When comparing credentials, especially MD5 sums (WTF, why are there still MD5 sums???) the unsalted hash of the stored password is leaked in a timing side channel. Based on this information an attacker might reconstruct the password hash and thus obtain the cleartext password through dictionary attacks or precomputed password lists.