Ensure strings are compared with hash_equals

For time-constant string comparison, we need to use a better comparison
than PHP's built-in `===` operator. WordPress has the hash_equals
function to do this, available since 3.9.2.

Thanks to @sarciszewski for reporting this responsibly, and apologies to
him for our late response.