Update auth.py

Let's compare hashes in constant-time, for several reasons:
* Consistency with CSRF token validation
* Paranoia -- could an attacker side-channel our password hash? (Not unless the salt was known.)