Fix timing side-channel attack in hmac comparison