Use timing safe string comparison in CSRF filter

Use a timing safe comparison, as provided by the Symfony Security Component.

As proposed by by @lasselehtinen and @ircmaxell in ba0cf2a

See also https://github.com/laravel/laravel/pull/3126