safe, constant-time string comparison