use hmac.compare_digest if available

I stole most of this code from webob where I had previously added it. Improved the testing situation however.

Pretty annoying that this is ``strings_differ`` and not ``constant_time_compare``, considering it returns ``False`` when strings are the same. Very counter-intuitive.