Update auth.py - constant_time_compare password hashes

Constant time comparison. (I eyeballed `check_csrf()` this time)
This line is a bit surprising. Does pbkdf2 return a string instead of a bytearray? I believe that would be incorrect.