Also prevent timing attacks if hash_equals() does not exist