Use a constant time equality check for HMAC signature verification
see #7 Merge branch 'aew-master'
see #7 Use `refer` instead of `as`