finalize _pbkdf2Slow function that takes configurable hash algo, and use constant time string compare for validating HMAC