Update auth.py - constant_time_compare password hashes

Constant time comparison. (I eyeballed `check_csrf()` this time)
It throws `TypeError: unicode argument without an encoding` without that line there.