Validation: Guard against timing attacks. Improves #76 and #77.

The check asked for in #76 and implemented in #77 uses non-constant time comparison to check the checksum supplied by Github.

From https://developer.github.com/webhooks/securing:

  Using a plain == operator is **not advised**.
  A method like `secure_compare` performs a "constant time" string
  comparison, which renders it safe from certain timing attacks against
  regular equality operators.