constant time comparison function should walk created hash

Comparison loop should operate on what we are sure is a hash, not input from
an external source.

	modified:   lib/App/bmkpasswd.pm
deleted:    xt/extended.t