Add resistance to remote timing attacks

Reference

* http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote-timing-attacks-on-php-applications-time-to-take-them-seriously/
* https://www.isecpartners.com/blog/2011/february/double-hmac-verification.aspx
* https://defuse.ca/blind-birthday-attack.htm