Fixed timing attack in cookie validation.

- See more details here: http://verboselogging.com/2012/08/20/a-timing-attack-in-action