Attempt to mitigate timing attacks

Comparing client input to secret values should be done in a secure, time-independent way.

See here: https://docs.python.org/2/library/hmac.html#hmac.compare_digest
It's also not strictly necessary to protect client_ids, since they're really public information.