avoid timing attacks using passlib consteq instead of ==

see hash prefix collisions here: http://www.security-assessment.com/files/documents/presentations/TimingAttackPresentation2012.pdf

unicode encoding is needed because passlib's consteq only works on unicode strings.