Validation: Guard against timing attacks. Improves #76 and #77.

From https://developer.github.com/webhooks/securing:

  Using a plain == operator is **not advised**.
  A method like `secure_compare` performs a "constant time" string
  comparison, which renders it safe from certain timing attacks against
  regular equality operators.