update hmac signature comparison

see https://docs.python.org/2/library/hmac.html#hmac.compare_digest

pinging @rgbkrk
Looks legit.