Use buffer-equal-constant-time

Avoid timing side-channel on the HMAC check by using a constant-time-complexity comparison function.