Use constant time string comparisson for validating HMAC signature
(fixes #26).