avoid timing attacks using passlib consteq instead of ==

see hash prefix collisions here: http://www.security-assessment.com/files/documents/presentations/TimingAttackPresentation2012.pdf

unicode encoding is needed because passlib's consteq only works on unicode strings.

of course this is particularly valid if passwords are stored as plaintext,
even if storing passwords in plaintext is not a good practice, it still is the default in flask-security actually, better safe than sorry.