Prevent timing attack on validity of auth token