using constant time string comparison for username/password, to prevent timing attacks. fixes #3