Use hash_equals for constant-time string comparison

Use the `hash_equals` function (introduced in PHP 5.6) for timing attack safe string comparison when available.
Add in the DocBlock that length will leak (see https://github.com/php/php-src/pull/792).