Look at bytes, not chars, in secure_equals