Fix for timing attacks on MAC verification.

This reapplies one of the patches originally documented in https://github.com/visionmedia/node-cookie-signature/pull/2. The timing attack patch was reverted for no good reason AFAICT.