Use `werkzeug.security.safe_str_cmp` instead of `hmac.compare_digest`.

https://github.com/lepture/flask-wtf/issues/135