Update auth.py - constant_time_compare password hashes

Constant time comparison. (I eyeballed `check_csrf()` this time)