Prevent timing attacks with VerifyHash

Thanks to @kristian.hellang