WSSE Auth: Timing safe comparison