modified:   note.py

HMAC comparison should be done before we attempt to uncompress, otherwise we
have a timing attack.

Additionally HMAC comparison should be done in constant time, again to prevent
timing attacks.

See http://codahale.com/a-lesson-in-timing-attacks/ for example.