Fix a timing attack

The HMAC validation code early-exits on mismatch, which would allow an attacker to reconstruct the hash one byte at a time.  Granted, assuming this is over SSL and SHA1 hasn't been broken there are still a number of obstacles that must be overcome, but better safe than sorry.
Maybe put a comment here saying we don't want to rely on MessageDigest because some people might be using a >4+ year old version of Java?

I can see people wondering why you are re-inventing the wheel.