constant time compare the slug to avoid timing attacks

Fixes #3