Use constant time comparison for HMAC in Python to prevent timing attack

I've also added a few unit tests for the Python library, so that we can be sure the HMAC is still being validated.