Fix timing side-channel attack in hmac via use of constant-time comparison