Constant-time string comparison in Phalcon\Security::checkHash()

Fix #1755