Use a constant-time compare to mitigate timing attacks