Use time constant string comparison to avoid timing attacks