Use hmac.compare_digest() to avoid timing attacks

Instead of the comparison operator, use hmac.compare_digest() reduce the
likeability of malicious users to deduice information about the passwords
using timing attacks.