java: add constant time compare for validating tokens.