Use timing safe string comparison in CSRF filter
Merge remote-tracking branch 'origin/develop' into develop

Conflicts:
	app/filters.php