Fixes #4131: Security adjustments

It's a one-commit with minor adjustments ([typo fix](https://github.com/yiisoft/yii2/pull/4163/files#diff-975a833ec7c81b58cf332ea9c882c795R231), [unused import](https://github.com/yiisoft/yii2/pull/4163/files#diff-975a833ec7c81b58cf332ea9c882c795R10) and [removal of null-data check](https://github.com/yiisoft/yii2/pull/4163/files#diff-45220ab88012b2d4eb27a69410afb5e6R215)) of #4163
Early return here makes the method useless as a 'timing attack protection' - as the 'timing attack resistant approach' assumes that `duration is always the same`, nevertheless what actual result is.

While, trying to implement 'timing attack' protection in this method is useless anyway - timing should be done starting from the user input. There are pretty much points where exceptions are thrown and verification procedure can be interrupted before it comes to `compareString` - so it will never last `exactly x seconds`.

I'm not even sure any means of 'timing attack protection' makes sense.
If attacker knows that it is Yii - he can just review the code on GitHub to know what security algos are used in it.

And to know that it is Yii will be easy in most cases, for example:

```
<script src="/assets/ad8bc8dd/yii.js"></script>
<script src="/assets/ad8bc8dd/yii.validation.js"></script>
<script src="/assets/ad8bc8dd/yii.activeForm.js"></script>
```