Update auth.py - constant_time_compare password hashes

Constant time comparison. (I eyeballed `check_csrf()` this time)
Okay, reading the pbkdf2 code, it looks like it does in fact return a string, and that string is base64 + a "$" as a separator, so encoding as UTF-8 shouldn't change the byte values. Looks good.