Constant time comparison

do HMAC comparison in constant time

fixes issue #1