Use hash_equals() for signature verification

This attempts to compare strings in a way that does not leak timing information.

http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote-timing-attacks-on-php-applications-time-to-take-them-seriously/