Typo
Also prevent timing attacks if hash_equals() does not exist